Ecosystem
Ubuntu
61,840 known vulnerabilities.
Most affected packages
12,735 results · Clear filters · Feed
-
Medium 4.3
An issue has been discovered in GitLab affecting all versions starting from 10.0 to 15.7.8, 15.8 prior to 15.8.4 and 15…
-
Medium 5.4
A issue has been discovered in GitLab CE/EE affecting all versions from 15.3 prior to 15.7.8, version 15.8 prior to 15.…
-
Medium 6.6
NULL Pointer Dereference in vim/vim
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1392.
-
Medium 5.3
Qemu: lsi53c895a: dma reentrancy issue leads to stack overflow
A vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack overflow or use-after-free.
-
Medium 6.3
ISO 15765 and ISO 10681 dissector crash in Wireshark 4.0.0 to 4.0.3 and 3.6.0 to 3.6.11 allows denial of service via pa…
-
Medium 6.5
A flaw was found in Ceph, relating to the URL processing on RGW backends. An attacker can exploit the URL processing by…
-
Medium 6.5
openstack-neutron uncontrolled resource consumption flaw
An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a mal…
-
Medium 5.5
A double-free memory flaw was found in the Linux kernel. The Intel GVT-g graphics driver triggers VGA card system resou…
-
Medium 5.3
Moodle has Incorrect Default Permissions
In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions.
-
Medium 4.8
Moodle vulnerable to Stored Cross-site Scripting
In Moodle, ID numbers exported in HTML data formats required additional sanitizing to prevent a local stored XSS risk.
-
Medium 5.3
Moodle Improper Input Validation vulnerability
In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk.
-
Medium 5.3
Moodle has Incorrect Default Permissions
In Moodle, insufficient capability checks meant message deletions were not limited to the current user.
-
Medium 5.4
Moodle Cross-site Scripting vulnerability
In Moodle, ID numbers displayed in the quiz override screens required additional sanitizing to prevent a stored XSS risk.
-
Medium 5.4
Moodle Cross-site Scripting vulnerability
In moodle, ID numbers displayed in the web service token list required additional sanitizing to prevent a stored XSS risk.
-
Medium 6.1
Cross Site Scripting (XSS) vulnerability in the DataTables plug-in 1.9.2 for jQuery allows attackers to run arbitrary c…
-
Medium 5.3
Moodle has a Hidden Functionality vulnerability
In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk.
-
Medium 5.0
ayttm proxy.c http_connect format string
A vulnerability, which was classified as critical, was found in ayttm up to 0.5.0.89. This affects the function http_connect in the library libproxy/proxy.c. The manipulation leads to format string. It is possible to initiate the attack remotely. The complexi…
-
Medium 6.1
Open redirect in web2py
Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirected to an arbitrary website by accessing a specially crafted URL. As a result, the user may become a victim of a phishing attack.
-
Medium 6.8
LibTIFF 4.4.0 has an out-of-bounds read in tiffcp in tools/tiffcp.c:948, allowing attackers to cause a denial-of-servic…
-
Medium 6.6
Gradle usage of long IDs for PGP keys opens potential for collision attacks
Gradle is a build tool with a focus on build automation and support for multi-language development. This is a collision attack on long IDs (64bits) for PGP keys. Users of dependency verification in Gradle are vulnerable if they use long IDs for PGP keys in a …
-
Medium 5.5
Integer Overflow in several Redis commands can lead to denial of service.
Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDFIELD` commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server p…
-
Medium 4.4
NVIDIA CUDA Toolkit SDK contains a vulnerability in cuobjdump, where a local user running the tool against a malicious …
-
Medium 6.4
Stored XSS in Grafana Text plugin
Grafana is an open-source platform for monitoring and observability. On 2023-01-01 during an internal audit of Grafana, a member of the security team found a stored XSS vulnerability affecting the core plugin "Text". The stored XSS vulnerability requires seve…
-
Medium 5.5CVE-2022-36021 EPSS 60%
Redis string pattern matching can be abused to achieve Denial of Service
Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. T…
-
Medium 5.5
libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ff_hevc_put_weighted_pred_avg_8_sse functi…
-
Medium 5.5
libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ff_hevc_put_weighted_pred_avg_8_sse functi…
-
Medium 5.5
libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the put_unweighted_pred_16_fallback function a…
-
Medium 5.5
libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ff_hevc_put_unweighted_pred_8_sse function…
-
Medium 5.5
libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the put_weighted_pred_8_fallback function at f…
-
Medium 4.0
In the Linux kernel before 5.16, tools/perf/util/expr.c lacks a check for the hashmap__new return value.
-
Medium 5.5
In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidp_planes.c misinterprets the get_sg_table return value (expec…
-
Medium 5.5
In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return value. Caller…
-
Medium 5.5
In the Linux kernel before 5.16.3, drivers/scsi/ufs/ufs-mediatek.c misinterprets the regulator_get return value (expect…
-
Medium 5.5
In the Linux kernel before 5.15.13, drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c misinterprets the mlx5…
-
Medium 5.5
In the Linux kernel before 6.2, mm/memory-tiers.c misinterprets the alloc_memory_type return value (expects it to be NU…
-
Medium 5.5
In the Linux kernel before 5.16.3, drivers/bluetooth/hci_qca.c misinterprets the devm_gpiod_get_index_optional return v…
-
Medium 5.5
TPM2.0 vulnerable to out-of-bounds read
An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can read or access sensitive dat…
-
Medium 5.5
Denial of service via crafted TIFF image in golang.org/x/image/tiff
An attacker can craft a malformed TIFF image which will consume a significant amount of memory when passed to DecodeConfig. This could lead to a denial of service.
-
Medium 5.5
In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction …
-
Medium 5.9
GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data …