Ecosystem
Ubuntu
61,840 known vulnerabilities.
Most affected packages
12,735 results · Clear filters · Feed
-
Medium 5.9
Integer underflow leading to stack overflow in FPC codec decompression
ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. This vulnerability is an integer underflow resulting in crash due to stack buffer overflow in decompression of FPC codec. It …
-
Medium 4.4
Kernel: null pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
A null pointer dereference vulnerability was found in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() in drivers/net/wireless/ath/ath10k/wmi-tlv.c in the Linux kernel. This issue could be exploited to trigger a denial of service.
-
Medium 5.5
W3m: out-of-bounds write in function checktype() in etc.c (incomplete fix for cve-2022-38223)
An out-of-bounds write issue has been discovered in the backspace handling of the checkType() function in etc.c within the W3M application. This vulnerability is triggered by supplying a specially crafted HTML file to the w3m binary. Exploitation of this flaw…
-
Medium 5.5
Tcpreplay: tcprewrite: double free in tcpedit_dlt_cleanup() in plugins/dlt_plugins.c
Within tcpreplay's tcprewrite, a double free vulnerability has been identified in the tcpedit_dlt_cleanup() function within plugins/dlt_plugins.c. This vulnerability can be exploited by supplying a specifically crafted file to the tcprewrite binary. This flaw…
-
Medium 6.5
A `<dialog>` element could have been manipulated to paint content outside of a sandboxed iframe. This could allow un…
-
Medium 6.5
Phpsysinfo Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery (CSRF) vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file.
-
Medium 6.3
Ansible: malicious role archive can cause ansible-galaxy to overwrite arbitrary files
An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.
-
Medium 4.6
Code injection in zabbix_agent2 smart.disk.get caused by smartctl plugin
The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote code execution.
-
Medium 6.8
Code execution vulnerability in icmpping
An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execute arbitrary code on the current Zabbix server.
-
Medium 5.9
Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server…
-
Medium 5.5
In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination const…
-
Medium 6.5
In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, an…
-
Medium 4.9
Improper User Management in GitLab
A privilege escalation vulnerability in GitLab EE affecting all versions from 16.0 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows a project Maintainer to use a Project Access Token to escalate their role to Owner
-
Medium 4.3
Improper Validation of Specified Type of Input in GitLab
An issue has been discovered in GitLab EE affecting all versions starting before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. It was possible to overflow the time spent on an issue that altered the deta…
-
Medium 4.3
Missing Authorization in GitLab
An issue has been discovered in GitLab affecting all versions starting from 9.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. In certain situations, it may have been possible for developers to ove…
-
Medium 4.8
Improper Control of Generation of Code ('Code Injection') in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 16.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. File integrity may be compromised when specific HTML encoding is used fo…
-
Medium 5.7
Improper Control of Generation of Code ('Code Injection') in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. File integrity may be compromised when source code or installation packages are pu…
-
Medium 6.0
Temporary data passed between application components by Budgie Extras Windows Previews could potentially be viewed or m…
-
Medium 6.0
Temporary data passed between application components by Budgie Extras WeatherShow applet could potentially be viewed or…
-
Medium 6.0
Temporary data passed between application components by Budgie Extras Takeabreak applet could potentially be viewed or …
-
Medium 6.0
Temporary data passed between application components by Budgie Extras Window Shuffler applet could potentially be viewe…
-
Medium 6.0
Temporary data passed between application components by Budgie Extras Dropby applet could potentially be viewed or mani…
-
Medium 6.0
Temporary data passed between application components by Budgie Extras Clockworks applet could potentially be viewed or …
-
Medium 4.9CVE-2023-49294 EPSS 45%
Asterisk Path Traversal vulnerability
Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, it is possible to read any arbitrary file even when the `live_dangerously` …
-
Medium 4.7
Apache Shiro: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Shiro.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+.
-
Medium 6.2
jq has stack-based buffer overflow in decNaNs
jq is a command-line JSON processor. Version 1.7 is vulnerable to stack-based buffer overflow in builds using decNumber. Version 1.7.1 contains a patch for this issue.
-
Medium 6.5CVE-2023-43813 EPSS 31%
glpi Authenticated SQL Injection
GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, the saved search feature can be used to perform a SQL injection. Version 10.0.11 contains a patch for the issue.
-
Medium 6.1
h2o vulnerable to TLS session resumption misdirection
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. In version 2.3.0-beta2 and prior, when h2o is configured to listen to multiple addresses or ports with each of them using different backend servers managed by multiple entities, a malicious b…
-
Medium 5.0CVE-2023-5536 Public exploit
A feature in LXD (LP#1829071), affects the default configuration of Ubuntu Server which allows privileged users in the …
-
Medium 5.3
When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requ…
-
Medium 5.3
Espeak-ng 1.52-dev was discovered to contain a buffer-overflow via the function SetUpPhonemeTable at synthdata.c.
-
Medium 5.5
Kernel: null pointer dereference in dpll_pin_parent_pin_set() in drivers/dpll/dpll_netlink.c
A null pointer dereference vulnerability was found in dpll_pin_parent_pin_set() in drivers/dpll/dpll_netlink.c in the Digital Phase Locked Loop (DPLL) subsystem in the Linux kernel. This issue could be exploited to trigger a denial of service.
-
Medium 4.3
Postgresql: memory disclosure in aggregate function calls
A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type d…
-
Medium 6.1
Cross-site Scripting in Semantic MediaWiki
Special:Ask in Semantic MediaWiki before 4.0.2 allows Reflected XSS.
-
Medium 5.5
Kernel: io_uring out of boundary memory access in __io_uaddr_map()
An out-of-bounds memory access flaw was found in the io_uring SQ/CQ rings functionality in the Linux kernel. This issue could allow a local user to crash the system.
-
Medium 5.5
Kernel: null pointer dereference vulnerability in nft_dynset_init()
A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in nf_tables in the Linux kernel. This issue may allow a local attacker with CAP_NET_ADMIN user privilege to trigger a denial of service.
-
Medium 6.5
This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than …
-
Medium 6.0
Qemu: 9pfs: improper access control on special files
A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a malicious client to escape from the exported 9p tree by creating and opening a dev…
-
Medium 5.9
Dependency on Vulnerable Third-Party Component in GitLab
Patch in third party library Consul requires 'enable-script-checks' to be set to False. This was required to enable a patch by the vendor. Without this setting the patch could be bypassed. This only affects GitLab-EE.
-
Medium 4.8
Improper Control of Generation of Code ('Code Injection') in GitLab
An issue has been discovered in GitLab affecting all versions before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. Under certain circumstances, a malicious actor bypass prohibited branch checks using a s…