Ecosystem
Ubuntu
61,840 known vulnerabilities.
Most affected packages
12,735 results · Clear filters · Feed
-
Medium 5.5
llvm-project commit bd456297 was discovered to contain a segmentation fault via the component mlir::Block::getArgument.
-
Medium 5.5
llvm-project commit fdbc55a5 was discovered to contain a segmentation fault via the component mlir::IROperand<mlir::OpO…
-
Medium 5.5
llvm-project commit a0138390 was discovered to contain a segmentation fault via the component mlir::spirv::TargetEnv::T…
-
Medium 6.5
libheif vulnerable to segmentation fault via floating point exception
A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the heif::Fraction::round() function in box.cc, which causes a denial of service.
-
Medium 5.3
A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation. An i…
-
Medium 5.6
Improper input validation in github.com/gin-gonic/gin
Versions of the package github.com/gin-gonic/gin before 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a specially crafted request via the X-Forwarded-Prefix header, potentially leading to cache poisoning. **Note:** Although …
-
Medium 4.8
An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15…
-
Medium 6.5
An issue has been discovered in GitLab affecting all versions starting from 13.11 before 15.8.5, all versions starting …
-
Medium 5.4
An issue has been discovered in GitLab CE/EE affecting all versions before 15.8.5, 15.9.4, 15.10.1. Open redirects was …
-
Medium 5.4
An issue has been discovered in GitLab affecting all versions starting from 11.9 before 15.9.6, all versions starting f…
-
Medium 4.4
A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 15.9.6, all …
-
Medium 4.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.1 before 15.10.8, all versions sta…
-
Medium 5.7
An issue has been discovered in GitLab CE/EE affecting all versions from 8.6 before 15.9.6, all versions starting from …
-
Medium 5.4CVE-2023-29839 Public exploit
A Stored Cross Site Scripting (XSS) vulnerability exists in multiple pages of Hotel Druid version 3.0.4, which allows a…
-
Medium 6.4
An issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all versions starting f…
-
Medium 5.5
An issue in the component hang.wasm of WebAssembly 1.0 causes an infinite loop.
-
Medium 4.4
Apache CouchDB, IBM Cloudant: Information sharing via couchjs processes
Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document functions: * validate_doc_update * list * filter * filter views (using view functions as filters) * re…
-
Medium 4.4
Automation user secret logged to Apache access log
Transmission of credentials within query parameters in Checkmk <= 2.1.0p26, <= 2.0.0p35, and <= 2.2.0b6 (beta) may cause the automation user's secret to be written to the site Apache access log.
-
Medium 6.5
Moodle: tinymce loaders susceptible to arbitrary folder creation
The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system.
-
Medium 5.6
Moodle: minor sql injection risk in external wiki method for listing pages
The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in external Wiki method for listing pages. A remote attacker can send a specially crafted request to the affected application and execute limited SQL comman…
-
Medium 6.8
Use of Out-of-range Pointer Offset in vim/vim
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499.
-
Medium 5.9
GitLab::API::v4 through 0.26 does not verify TLS certificates when connecting to a GitLab server, enabling machine-in-t…
-
Medium 5.5
swfrender v0.9.2 was discovered to contain a heap buffer overflow in the function enumerateUsedIDs_fillstyle at modules…
-
Medium 5.5
sensitive data exposure in cloud-init logs
Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege.
-
Medium 5.3
Spectre V1 Gadget in do_prlimit in the Linux Kernel
A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be used to leak the contents. We recommend upgrading…
-
Medium 4.2
Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana introduced t…
-
Medium 6.5
Drupal core - Moderately critical - Access bypass - SA-CORE-2023-005
The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to. Some sites may require configuration changes following this security relea…
-
Medium 5.4
Access bypass in Drupal core
Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permissions, resulting in some possible access bypass for users who have access to use revisions of content generally, but w…
-
Medium 6.1
Lack of domain validation in Druple core
The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulner…
-
Medium 6.5
Access bypass in Drupal Core
Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added…
-
Medium 4.7CVE-2023-0045 Public exploit
Incorrect indirect branch prediction barrier in the Linux Kernel
The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ib_prctl_set function updates the Thread Information Flags (TIFs) for the task and updates the SPEC_CTRL MSR on the function __speculation_ctrl_update,…
-
Medium 6.5CVE-2021-26947 Scanner template
Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote at…
-
Medium 5.3
Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows authenticated at…
-
Medium 6.5
Cross-site scripting (XSS) issue in Website app of Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier…
-
Medium 6.8
A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated adminis…
-
Medium 6.5
Improper access control in reporting engine of l10n_fr_fec module in Odoo Community 15.0 and earlier and Odoo Enterpris…
-
Medium 5.3
Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote at…
-
Medium 5.4
Apache Jena: Exposure of arbitrary execution in script engine expressions.
There is insufficient checking of user queries in Apache Jena versions 4.7.0 and earlier, when invoking custom scripts. It allows a remote user to execute arbitrary javascript via a SPARQL query.
-
Medium 6.5
In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequentl…
-
Medium 5.3
Ribose RNP before 0.16.3 may hang when the input is malformed.