Ecosystem
Ubuntu
61,840 known vulnerabilities.
Most affected packages
12,735 results · Clear filters · Feed
-
Medium 5.5
Buffer Overflow vulnerability found in SQLite3 v.3.27.1 and before allows a local attacker to cause a denial of service…
-
Medium 6.4
praecis_parse in ntpd/refclock_palisade.c in NTP 4.2.8p15 has an out-of-bounds write. Any attack method would be comple…
-
Medium 5.6
mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp<cpdec while loop. An adversary may be …
-
Medium 5.6
mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. An adversary may b…
-
Medium 5.6
mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point. An adversary may be…
-
Medium 5.6
mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when copying the trailing number. An adversary m…
-
Medium 6.5
An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64 lacks consistency…
-
Medium 6.5CVE-2023-24626 Public exploit
socket.c in GNU Screen through 4.9.0, when installed setuid or setgid (the default on platforms such as Arch Linux and …
-
Medium 4.4
aufs: improperly managed inode reference counts in the vfsub_dentry_open() method
It was discovered that aufs improperly managed inode reference counts in the vfsub_dentry_open() method. A local attacker could use this vulnerability to cause a denial of service attack.
-
Medium 6.5
An issue was discovered in libbzip3.a in bzip3 before 1.3.0. A denial of service (process hang) can occur with a crafte…
-
Medium 6.5
An issue was discovered in libbzip3.a in bzip3 before 1.2.3. There is an xwrite out-of-bounds read.
-
Medium 6.5
An issue was discovered in libbzip3.a in bzip3 before 1.3.0. A bz3_decode_block out-of-bounds write can occur with a cr…
-
Medium 6.5
An issue was discovered in libbzip3.a in bzip3 before 1.2.3. There is a crash caused by an invalid memmove in bz3_decod…
-
Medium 5.5
SageMath FlintQS 1.0 relies on pathnames under TMPDIR (typically world-writable), which (for example) allows a local us…
-
Medium 6.5
An issue was discovered in libbzip3.a in bzip3 before 1.2.3. There is a bz3_decode_block out-of-bounds read.
-
Medium 4.8
GLPI vulnerable to stored Cross-site Scripting through dashboard administration
GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to versions 9.5.13 and 10.0.7, a user with dashboard administration rights may hack the dashboard form to store malicious code that will be executed when other users …
-
Medium 4.5
GLPI vulnerable to stored Cross-site Scripting in external links
GLPI is a free asset and IT management software package. Starting in version 0.60 and prior to versions 9.5.13 and 10.0.7, a vulnerability allows an administrator to create a malicious external link. This issue is fixed in versions 9.5.13 and 10.0.7.
-
Medium 5.8
An issue has been discovered in GitLab affecting all versions starting from 13.6 before 15.8.5, all versions starting f…
-
Medium 5.4
An issue has been discovered in GitLab affecting all versions starting from 15.6 before 15.8.5, 15.9 before 15.9.4, and…
-
Medium 5.5
An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.…
-
Medium 5.3
xml2js 0.4.23 - Prototype Pollution
xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the __proto__ property to be edited.
-
Medium 6.1
GLPI vulnerable to reflected Cross-site Scripting in search pages
GLPI is a free asset and IT management software package. Starting in version 0.85 and prior to versions 9.5.13 and 10.0.7, a malicious link can be crafted by an unauthenticated user. It will be able to exploit a reflected XSS in case any authenticated user op…
-
Medium 6.3
A use-after-free flaw was found in xgene_hwmon_remove in drivers/hwmon/xgene-hwmon.c in the Hardware Monitoring Linux K…
-
Medium 4.3
An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting f…
-
Medium 4.7
A race problem was found in fs/proc/task_mmu.c in the memory management sub-component in the Linux kernel. This issue m…
-
Medium 5.8
A denial of service condition exists in the Prometheus server bundled with GitLab affecting all versions from 11.10 to …
-
Medium 5.3
A sensitive information disclosure vulnerability in GitLab affecting all versions from 15.0 prior to 15.8.5, 15.9 prior…
-
Medium 5.8
An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11.5 b…
-
Medium 5.7
An issue was identified in GitLab CE/EE affecting all versions from 1.0 prior to 15.8.5, 15.9 prior to 15.9.4, and 15.1…
-
Medium 4.3
An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting f…
-
Medium 6.1
An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.8.5, all versions starting f…
-
Medium 6.8
moby/moby's dockerd daemon encrypted overlay network traffic may be unencrypted
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly r…
-
Medium 6.8
moby/moby's dockerd daemon encrypted overlay network with a single endpoint is unauthenticated
Moby) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly …
-
Medium 5.4
Nextcloud Desktop client does not verify received singed certificate in end-to-end encryption
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.7.0, by trusting that the server will return a certificate that belongs to the keypair of the user, a malicious server could …
-
Medium 6.9
Nextcloud: Lack of authenticity of metadata keys allows a malicious server to gain access to E2EE folders
Nextcloud is an open-source productivity platform. In Nextcloud Desktop client 3.0.0 until 3.8.0, Nextcloud Android app 3.13.0 until 3.25.0, and Nextcloud iOS app 3.0.5 until 4.8.0, a malicious server administrator can gain full access to an end-to-end encryp…
-
Medium 6.7
Nextcloud Desktop client misbehaves with E2EE when the server returns empty list of metadata keys
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover…
-
Medium 6.7
Nextcloud Desktop: Initialization vector reuse in E2EE allows malicious server admin to break, manipulate, access files
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server administrator can recover and modify the contents of end-to-end encrypted files. Users should upgrade…
-
Medium 5.5
An issue found in Eteran edb-debugger v.1.3.0 allows a local attacker to causea denial of service via the collect_symbo…
-
Medium 6.5
ADMesh improper array index validation
An improper array index validation vulnerability exists in the stl_fix_normal_directions functionality of ADMesh Master Commit 767a105 and v0.98.4. A specially-crafted stl file can lead to a heap buffer overflow. An attacker can provide a malicious file to tr…
-
Medium 5.9
The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset pas…