1,460 results · Clear filters · Feed
-
Critical max 9.8USN-6992-1 8 CVEs
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary c…
first Sep 5, 2024 -
Critical max 9.8USN-6995-1 10 CVEs
thunderbird vulnerabilities
Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass secu…
first Sep 9, 2024 -
Critical max 9.8USN-7086-1 11 CVEs
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary c…
first Oct 31, 2024 -
Critical max 9.8USN-7056-1 11 CVEs
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary c…
first Oct 7, 2024 -
Critical max 9.0USN-7055-1 1 CVE
freeradius vulnerability
Goldberg, Miro Haller, Nadia Heninger, Mike Milano, Dan Shumow, Marc Stevens, and Adam Suhl discovered that FreeRADIUS incorrectly authenticated certain responses. An attacker able to intercept communications between a RADIUS client and server could possibly …
first Oct 3, 2024 -
Critical max 9.8USN-7061-1 11 CVEs
golang-1.17 vulnerabilities
Hunter Wittenborn discovered that Go incorrectly handled the sanitization of environment variables. An attacker could possibly use this issue to run arbitrary commands. (CVE-2023-24531) Sohom Datta discovered that Go did not properly validate backticks (`) as…
first Oct 10, 2024 -
Critical max 10.0USN-7046-1 1 CVE
bubblewrap, flatpak vulnerability
It was discovered that Flatpak incorrectly handled certain persisted directories. An attacker could possibly use this issue to read and write files in locations it would not normally have access to. A patch was also needed to Bubblewrap in order to avoid race…
first Sep 30, 2024 -
Critical max 9.8USN-7001-2 2 CVEs
libxmltok vulnerabilities
USN-7001-1 fixed vulnerabilities in xmltol library. This update provides the corresponding updates for Ubuntu 24.04 LTS. Original advisory details: Shang-Hung Wan discovered that Expat, contained within the xmltok library, did not properly handle certain func…
first Sep 17, 2024 -
Critical max 9.8USN-7000-2 3 CVEs
expat vulnerabilities
USN-7000-1 fixed vulnerabilities in Expat. This update provides the corresponding updates for Ubuntu 22.04 LTS. Original advisory details: Shang-Hung Wan discovered that Expat did not properly handle certain function calls when a negative input length was pro…
first Sep 17, 2024 -
Critical max 9.8USN-6886-1 9 CVEs
golang-1.21, golang-1.22 vulnerabilities
It was discovered that the Go net/http module did not properly handle the requests when request\'s headers exceed MaxHeaderBytes. An attacker could possibly use this issue to cause a panic resulting into a denial of service. This issue only affected Go 1.21 i…
first Jul 9, 2024 -
Critical max 9.8USN-6759-1 5 CVEs
freerdp3 vulnerabilities
It was discovered that FreeRDP incorrectly handled certain memory operations. If a user were tricked into connecting to a malicious server, a remote attacker could possibly use this issue to cause FreeRDP to crash, resulting in a denial of service.
first Apr 29, 2024 -
Critical max 9.8USN-6736-2 4 CVEs
klibc vulnerabilities
USN-6736-1 fixed vulnerabilities in klibc. This update provides the corresponding updates for Ubuntu 24.04 LTS. Original advisory details: It was discovered that zlib, vendored in klibc, incorrectly handled pointer arithmetic. An attacker could use this issue…
first May 23, 2024 -
Critical max 9.1USN-6682-1 6 CVEs
puma vulnerabilities
ZeddYu Lu discovered that Puma incorrectly handled parsing certain headers. A remote attacker could possibly use this issue to perform an HTTP Request Smuggling attack. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-11076) It was discovered that Puma in…
first Mar 7, 2024 -
Critical max 9.8USN-6703-1 11 CVEs
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary c…
first Mar 20, 2024 -
Critical max 9.1USN-6852-1 1 CVE
wget vulnerability
It was discovered that Wget incorrectly handled semicolons in the userinfo subcomponent of a URI. A remote attacker could possibly trick a user into connecting to a different host than expected.
first Jun 26, 2024 -
Critical max 9.8USN-6853-1 1 CVE
ruby2.7, ruby3.0, ruby3.1 vulnerability
It was discovered that Ruby incorrectly handled the ungetbyte and ungetc methods. A remote attacker could use this issue to cause Ruby to crash, resulting in a denial of service, or possibly obtain sensitive information.
first Jun 26, 2024 -
Critical max 10.0USN-6786-1 1 CVE
netatalk vulnerabilities
It was discovered that Netatalk did not properly protect an SMB and AFP default configuration. A remote attacker could possibly use this issue to execute arbitrary code.
first May 28, 2024 -
Critical max 9.8USN-6752-1 4 CVEs
freerdp2 vulnerabilities
It was discovered that FreeRDP incorrectly handled certain memory operations. If a user were tricked into connecting to a malicious server, a remote attacker could possibly use this issue to cause FreeRDP to crash, resulting in a denial of service.
first Apr 25, 2024 -
Critical max 9.8USN-6749-1 7 CVEs
freerdp2 vulnerabilities
It was discovered that FreeRDP incorrectly handled certain context resets. If a user were tricked into connecting to a malicious server, a remote attacker could use this issue to cause FreeRDP to crash, resulting in a denial of service, or possibly execute ar…
first Apr 24, 2024 -
Critical max 9.8USN-6720-1 1 CVE
cacti vulnerability
Kentaro Kawane discovered that Cacti incorrectly handled user provided input sent through request parameters to the graph_view.php script. A remote authenticated attacker could use this issue to perform SQL injection attacks.
first Apr 2, 2024 -
Critical max 9.1USN-6667-1 1 CVE
libcpanel-json-xs-perl vulnerability
It was discovered that Cpanel-JSON-XS incorrectly decoded certain data. A remote attacker could use this issue to cause Cpanel-JSON-XS to crash, resulting in a denial of service, or possibly obtain sensitive information.
first Feb 28, 2024 -
Critical max 9.8USN-6643-1 1 CVE
node-ip vulnerability
Emre Durmaz discovered that NPM IP package incorrectly distinguished between private and public IP addresses. A remote attacker could possibly use this issue to perform Server-Side Request Forgery (SSRF) attacks.
first Feb 19, 2024 -
Critical max 9.8USN-6587-1 6 CVEs
xorg-server, xwayland vulnerabilities
Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled memory when processing the DeviceFocusEvent and ProcXIQueryPointer APIs. An attacker could possibly use this issue to cause the X Server to crash, obtain sensitive information, or execute …
first Jan 16, 2024 -
Critical max 9.8USN-6966-1 13 CVEs
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary c…
first Aug 19, 2024 -
Critical max 9.3USN-6500-1 5 CVEs
squid vulnerabilities
Joshua Rogers discovered that Squid incorrectly handled validating certain SSL certificates. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 23.04, an…
first Nov 21, 2023 -
Critical max 9.8USN-6422-1 20 CVEs
ring vulnerabilities
It was discovered that Ring incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to execute arbitrary code. (CVE-2021-37706) It was disco…
first Oct 9, 2023 -
Critical max 9.8USN-6277-2 2 CVEs
php-dompdf vulnerabilities
USN-6277-1 fixed vulnerabilities in Dompdf. This update provides the corresponding updates for Ubuntu 22.04 LTS. Original advisory details: It was discovered that Dompdf was not properly validating untrusted input when processing HTML content under certain ci…
first Aug 10, 2023 -
Critical max 9.8USN-6525-1 1 CVE
pysha3 vulnerability
Nicky Mouha discovered that pysha incorrectly handled certain SHA-3 operations. An attacker could possibly use this issue to cause pysha3 to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Nov 29, 2023 -
Critical max 9.8USN-6524-1 1 CVE
pypy3 vulnerability
Nicky Mouha discovered that PyPy incorrectly handled certain SHA-3 operations. An attacker could possibly use this issue to cause PyPy to crash, resulting in a denial of service, or possibly execute arbitrary code.
first Nov 29, 2023 -
Critical max 9.8USN-6483-1 1 CVE
tidy-html5 vulnerability
Neeraj Pal discovered that HTML Tidy incorrectly handled parsing certain HTML data. If a user or automated system were tricked into parsing specially crafted HTML data, a remote attacker could cause HTML Tidy to consume resources, leading to a denial of servi…
first Nov 15, 2023 -
Critical max 9.4USN-6305-1 2 CVEs
php8.1 vulnerabilities
It was discovered that PHP incorrectly handled certain XML files. An attacker could possibly use this issue to expose sensitive information. (CVE-2023-3823) It was discovered that PHP incorrectly handled certain PHAR files. An attacker could possibly use this…
first Aug 23, 2023 -
Critical max 9.8USN-5936-1 6 CVEs
samba vulnerabilities
Evgeny Legerov discovered that Samba incorrectly handled buffers in certain GSSAPI routines of Heimdal. A remote attacker could possibly use this issue to cause Samba to crash, resulting in a denial of service. (CVE-2022-3437) Tom Tervoort discovered that Sam…
first Mar 8, 2023 -
Critical max 9.8USN-6038-1 20 CVEs
golang-1.18 vulnerabilities
It was discovered that the Go net/http module incorrectly handled Transfer-Encoding headers in the HTTP/1 client. A remote attacker could possibly use this issue to perform an HTTP Request Smuggling attack. (CVE-2022-1705) It was discovered that Go did not pr…
first Apr 25, 2023 -
Critical max 9.8USN-5942-1 2 CVEs
apache2 vulnerabilities
Lars Krapf discovered that the Apache HTTP Server mod_proxy module incorrectly handled certain configurations. A remote attacker could possibly use this issue to perform an HTTP Request Smuggling attack. (CVE-2023-25690) Dimas Fariski Setyawan Putra discovere…
first Mar 9, 2023 -
Critical max 9.8USN-5824-1 29 CVEs
thunderbird vulnerabilities
Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass secu…
first Feb 6, 2023 -
Critical max 9.4USN-6102-1 3 CVEs
node-xmldom vulnerabilities
It was discovered that xmldom incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause unexpected syntactic changes during XML proce…
first May 24, 2023 -
Critical max 9.8USN-6242-1 1 CVE
openssh vulnerability
It was discovered that OpenSSH incorrectly handled loading certain PKCS#11 providers. If a user forwarded their ssh-agent to an untrusted system, a remote attacker could possibly use this issue to load arbitrary libraries from the user's system and execute ar…
first Jul 24, 2023 -
Critical max 9.8USN-6204-1 1 CVE
cpdb-libs vulnerability
Seth Arnold discovered that CPDB incorrectly handled certain characters. An attacker could possibly use this issue to cause a crash or execute arbitrary code.
first Jul 5, 2023 -
Critical max 9.8USN-6189-1 1 CVE
etcd vulnerability
It was discovered that etcd leaked credentials when debugging was enabled. This allowed remote attackers to discover etcd authentication credentials and possibly escalate privileges on systems using etcd.
first Jun 28, 2023 -
Critical max 9.1USN-6067-1 5 CVEs
neutron vulnerabilities
David Sinquin discovered that OpenStack Neutron incorrectly handled the default Open vSwitch firewall rules. An attacker could possibly use this issue to impersonate the IPv6 addresses of other systems on the network. This issue only affected Ubuntu 18.04 LTS…
first May 10, 2023