Ecosystem
Ubuntu
61,691 known vulnerabilities.
Most affected packages
61,260 results · Feed
-
Low 2.2
Password hash disclosure to "view only" admin users with custom user models
An issue was discovered in Django 6.1 before 6.1.3 and 6.0 before 6.0.10. The `django.contrib.admin.utils.display_for_field()` function did not obfuscate the password field of user models other than `AUTH_USER_MODEL`, or of an `AUTH_USER_MODEL` inheriting its…
-
Low 3.1
Potential exposure of private data via empty and missing Vary headers
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. The `django.middleware.cache.UpdateCacheMiddleware` and the `django.views.decorators.cache.cache_page()` decorator generate identical cache keys for requests that om…
-
Medium 5.3
Server-side request forgery via crs member of GeoJSON geometries
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. `django.contrib.gis.gdal.OGRGeometry` does not restrict external coordinate reference system definitions in GeoJSON input, which allows remote attackers to cause ser…
-
Medium 5.3
Potential log injection via unescaped geometry form values
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. `django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize()`, used by `django.contrib.gis.forms.GeometryField`, does not escape invalid submitted values befor…
-
Medium 5.3
Potential memory exhaustion in MultiPartParser via base64-encoded file upload
An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19. `django.http.multipartparser.MultiPartParser` is subject to excessive memory consumption when processing multipart file uploads with base64 `Content-Transfer-En…
-
Medium 5.4
NULL Pointer Dereference in H5HL_unprotect via Corrupted File
HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HL_unprotect() in src/H5HL.c. H5HL_protect() pins a single metadata cache entry for a local heap, either the heap prefix or the separate data block, and H5HL_unprotect() unpins it on th…
-
High 7.0
NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket handling code.
-
Medium 5.3
NVIDIA Slurm contains a vulnerability where a user could deliberately alter the provided nodelist alongside the --distr…
-
Medium 5.7
NVIDIA Slurm contains some inconsistent authorization checks against the Operator permission level in the SlurmDBD that…
-
Medium 6.3
NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that can lead to arbitrary c…
-
Medium 6.9
Heap Buffer Over-read via Non-Terminated Link Data in H5L__extern_traverse
HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5L__extern_traverse() in src/H5Lexternal.c, the default traversal callback for external links. The callback locates the target file name and object path within the link’s user data using st…
-
Medium 6.3
NVIDIA Slurm contains an attacker-controlled arbitrary-memory read in the slurmstepd socket API that could be used to e…
-
Medium 4.7
NVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that could allow an attacker to rem…
-
Low 1.9
Heap Buffer Over-read via Malformed Message Size in HDF5's H5O__chunk_deserialize
HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5O__chunk_deserialize() in src/H5Ocache.c. When decoding object header messages, the declared message size is checked against the end of the chunk image before the remainder of the message …
-
Medium 4.7
Integer Underflow Leads to Out-of-Bounds Read via Truncated Chunk in HDF5 Szip Filter
HDF5 through 2.2.0 contains an out-of-bounds read vulnerability in H5Z__filter_szip() in src/H5Zszip.c. When decoding a szip-compressed chunk, the function subtracts the 4-byte uncompressed-length header from the chunk length without first verifying that the …
-
High 7.5
rsync < 3.5.2 Denial of Service via hash_search() Checksum Collisions
rsync before 3.5.2 contains a denial of service vulnerability in the delta-transfer sender's hash_search() in match.c that allows malicious receivers to trigger unbounded strong-checksum work at consecutive offsets. Unauthenticated attackers pulling from a pu…
-
Low 1.9
Uninitialized Heap Memory Disclosure via Truncated Chunk in HDF5 Scale-Offset Filter
HDF5 through 2.2.0 contains an uninitialized memory read vulnerability in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c. The decode path validates reads against the allocated size of the chunk buffer rather than the number of bytes actually read from the …
-
Medium 6.3
NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd process while the slurmstepd …
-
Medium 6.3
NVIDIA Slurm contains a vulnerability where a user could alter the supplemental group list as part of an sbcast file tr…
-
High 7.2
GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 Privilege Escalation via User Cloning
GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 contains a privilege escalation vulnerability that allows authenticated users to obtain elevated profiles by cloning accounts. A user with the Technician profile can clone a Super-Admin account with a new l…
-
Medium 5.4
PostfixAdmin through 4.0.5 Stored XSS via TOTP Exception Description
PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the scr…
-
Low 3.3
nnn through 5.3 Symlink-Following Write via NNN_FIFO Handling
nnn through 5.3 contains an insecure file handling vulnerability that allows local attackers to redirect writes because main() accepts an existing NNN_FIFO path without verifying it is a FIFO. Attackers can pre-create the documented predictable /tmp/nnn.fifo …
-
Medium 4.4
nnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins
nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp. Attackers can pre-create a symlink at the name-derived or PID-derived pat…
-
High 7.8
nnn through 5.3 OS Command Injection via togglex Plugin
Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute commands via crafted filenames. Attackers can place files whose names contain a double quote and shell syntax, which xargs -I splices into…
-
High 7.5
Mistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimiters
Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU through quadratic-time emphasis delimiter processing. Attackers can submit small markdown documents with repeated patterns like "*a_b" to tr…
-
Medium 5.3
Mistune before 3.3.3 Denial of Service via Balanced Bracket Link Parsing
Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parse_link that allows attackers to cause quadratic CPU growth by supplying balanced nested brackets. Attackers can submit crafted Markdown with thousands of nested bracket pairs …
-
Medium 6.5
Nodemailer 3.0.0 before 10.1.4 Recipient Domain Confusion via addressparser
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '>' inside a quoted local part, comment or domain literal. Attackers can submit addresses that validate as an allowed domain but are de…
-
Medium 6.5
Nodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested Comments
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested…
-
Medium 6.5
Nodemailer 3.0.0 before 10.1.4 Recipient Injection via addressparser Group Parsing
Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail …
-
Medium 6.5
FreeRDP 3.0.0 before 3.32.2 Proxy Memory Exhaustion via DVC Reassembly
FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption vulnerability in the proxy that lets connected clients retain heap memory via intercepted DVC message reassembly. Attackers can declare a large DATA_FIRST length and keep sending f…
-
Medium 4.3
FreeRDP before 3.32.2 Denial of Service via RDPGFX ALPHA WIRETOSURFACE_2
FreeRDP before 3.32.2 contains a denial of service vulnerability in the RDPGFX ALPHA WIRETOSURFACE_2 handler that fails to validate zero surface dimensions. A malicious RDP server can send a crafted WIRETOSURFACE_2 PDU with zero width and height, triggering a…
-
Low 3.1
FreeRDP before 3.32.2 X11 Client Abort via RDPGFX Scaled Output Geometry
FreeRDP before 3.32.2 fails to bound server-supplied target dimensions and output origin in RDPGFX MAPSURFACETOSCALEDOUTPUT PDUs, allowing malicious RDP servers to abort X11 clients. Attackers can map a surface to oversized scaled output, triggering checked U…
-
Medium 5.9
FreeRDP before 3.32.2 Denial of Service via Oversized X.224 Routing Token
FreeRDP before 3.32.2 contains a denial of service vulnerability that allows malicious servers or unauthenticated peers to abort clients or proxies via oversized X.224 routing tokens. Attackers can send an oversized LoadBalanceInfo in a Server Redirection PDU…
-
Medium 5.3
FreeRDP before 3.32.2 Use-After-Free via USB Redirection Control Channel
FreeRDP before 3.32.2 contains a use-after-free in the urbdrc USB redirection channel because FindChannelById returns a channel pointer without a reference and the control-channel close path does not take the device manager's loading_lock. A malicious RDP ser…
-
Medium 6.5
FreeRDP before 3.32.2 Shadow Server Denial of Service via remdesk Channel
FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server's remdesk_server_thread that allows authenticated clients to crash the process via an inverted PDU length check. Attackers can send an 8192-byte remdesk payload declaring an…
-
Medium 4.3
FreeRDP before 3.32.2 Client Denial of Service via Zero-Output ZGFX Payload
FreeRDP before 3.32.2 allows a client assertion abort because rdpgfx_on_data_received rejects only negative zgfx_decompress status and passes the resulting null output pointer to Stream_StaticConstInit. A malicious RDP server can send a zero-output ZGFX paylo…
-
Medium 4.3
FreeRDP before 3.32.2 Memory Exhaustion via Serial RDPDR Device Control
FreeRDP before 3.32.2 fails to cap the OutputBufferLength in serial device-control IRP requests, allowing malicious servers to trigger excessive memory allocation. Attackers running a server with serial redirection can send an IRP_MJ_DEVICE_CONTROL request wi…
-
Medium 6.5
FreeRDP before 3.32.2 Shadow Server CPU Exhaustion via Zero-Length DVC DATA
FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server threads by sending zero-length drdynvc DATA PDUs. Attackers can send empty DATA messages on opened audin or rdpgfx chann…
-
Medium 4.3
FreeRDP before 3.32.2 Denial of Service via Malformed Drive IRP
FreeRDP before 3.32.2 contains a denial of service vulnerability where a malformed drive DEVICE_IOREQUEST with a truncated IRP_MJ_CREATE body silently kills the drive worker. A malicious RDP server can send such an IRP then post further requests that accumula…
-
Medium 6.5
FreeRDP before 3.32.2 X11 Client Crash via Zero-Width RDPGFX ResetGraphics
FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows malicious RDP servers to crash xfreerdp clients by sending a zero-width RDPGFX ResetGraphics PDU. The failed resize in gdi_resize_ex leaves the primary display null without en…