cve.bz

debian debian linux vulnerabilities, newest first, page 100

Filter
  1. 9.8CVE-2013-2745EPSS 2.0%

    An SQL Injection vulnerability exists in MiniDLNA prior to 1.1.0

  2. 5.3CVE-2015-7542EPSS 0.4%

    A vulnerability exists in libgwenhywfar through 4.12.0 due to the usage of outdated bundled CA certificates.

  3. 8.8CVE-2013-7325EPSS 1.8%

    An issue exists in uscan in devscripts before 2.13.19, which could let a remote malicious user execute arbitrary code via a crafted tarball.

  4. 4.6CVE-2019-19536EPSS 0.4%

    In the Linux kernel before 5.2.9, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_pro.c driver, aka CID-ead16e53c2f0.

  5. 4.6CVE-2019-19535EPSS 0.5%

    In the Linux kernel before 5.2.9, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_fd.c driver, aka CID-30a8beeb3042.

  6. 2.4CVE-2019-19534EPSS 0.5%

    In the Linux kernel before 5.3.11, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_core.c driver, aka CID-f7a1337f0d29.

  7. 6.8CVE-2019-19531EPSS 0.5%

    In the Linux kernel before 5.2.9, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/yurex.c driver, aka CID-fc05481b2fca.

  8. 4.6CVE-2019-19530EPSS 0.4%

    In the Linux kernel before 5.2.10, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/class/cdc-acm.c driver, aka CID-c52873e5a1ef.

  9. 6.8CVE-2019-19527EPSS 0.4%

    In the Linux kernel before 5.2.10, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/hid/usbhid/hiddev.c driver, aka CID-9c09b214f30e.

  10. 4.6CVE-2019-19525EPSS 0.5%

    In the Linux kernel before 5.3.6, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/net/ieee802154/atusb.c driver, aka CID-7fd25e6fc035.

  11. 4.6CVE-2019-19524EPSS 0.7%

    In the Linux kernel before 5.3.12, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/input/ff-memless.c driver, aka CID-fa3a5a1880c9.

  12. 4.6CVE-2019-19523EPSS 0.4%

    In the Linux kernel before 5.3.7, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/adutux.c driver, aka CID-44efc269db79.

  13. 4.7CVE-2013-4235EPSS 0.3%

    shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees

  14. 7.5CVE-2013-2106EPSS 1.6%

    webauth before 4.6.1 has authentication credential disclosure

  15. 7.8CVE-2012-4576EPSS 0.4%

    FreeBSD: Input Validation Flaw allows local users to gain elevated privileges

  16. 7.5CVE-2012-4428EPSS 10%

    openslp: SLPIntersectStringList()' Function has a DoS vulnerability

  17. 5.5CVE-2019-19479EPSS 0.4%

    An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-setcos.c has an incorrect read operation during parsing of a SETCOS file attribute.

  18. 9.8CVE-2019-18609EPSS 3.3%

    An issue was discovered in amqp_handle_input in amqp_connection.c in rabbitmq-c 0.9.0. There is an integer overflow that leads to heap memory corruption in the handling of CONNECTION_STATE_HEADER. A rogue server could return a malicious fr…

  19. 4.9CVE-2019-19269EPSS 1.6%

    An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b. A dereference of a NULL pointer may occur. This pointer is returned by the OpenSSL sk_X509_REVOKED_value() function when encountering an empty CRL installed by a system a…

  20. 5.5CVE-2019-19462EPSS 0.5%

    relay_open in kernel/relay.c in the Linux kernel through 5.4.1 allows local users to cause a denial of service (such as relay blockage) by triggering a NULL alloc_percpu result.

  21. 5.9CVE-2015-0837EPSS 2.0%

    The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to obtain sensitive information by leveraging timing differences when accessing a pre-computed table during modular exponentiation, related to a "Last…

  22. 4.2CVE-2014-3591EPSS 0.6%

    Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server's private key by determining factors using crafted ciphertext an…

  23. 5.9CVE-2015-1855EPSS 2.8%

    verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related t…

  24. 9.8CVE-2019-14901EPSS 16%

    A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver. The vulnerability allows a remote attacker to cause a system crash, resulting in a denial of service, or execute a…

  25. 9.8CVE-2019-14897EPSS 2.9%

    A stack-based buffer overflow was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. An attacker is able to cause a denial of service (system crash) or, possibly execute arbitrary code, when a STA works in IBSS …

  26. 9.8CVE-2019-14895EPSS 7.8%

    A heap-based buffer overflow was discovered in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver. The flaw could occur when the station attempts a connection negotiation during the handling of the re…

  27. 4.4CVE-2019-19318EPSS 0.6%

    In the Linux kernel 5.3.11, mounting a crafted btrfs image twice can cause an rwsem_down_write_slowpath use-after-free because (in rwsem_can_spin_on_owner in kernel/locking/rwsem.c) rwsem_owner_flags returns an already freed pointer,

  28. 9.8CVE-2011-2523ExploitEPSS 96%

    vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

  29. 5.3CVE-2011-2515EPSS 0.4%

    PackageKit 0.6.17 allows installation of unsigned RPM packages as though they were signed which may allow installation of non-trusted packages and execution of arbitrary code.

  30. 6.5CVE-2013-2625EPSS 1.3%

    An Access Bypass issue exists in OTRS Help Desk before 3.2.4, 3.1.14, and 3.0.19, OTRS ITSM before 3.2.3, 3.1.8, and 3.0.7, and FAQ before 2.2.3, 2.1.4, and 2.0.8. Access rights by the object linking mechanism is not verified

  31. 5.3CVE-2011-2207EPSS 1.2%

    dirmngr before 2.1.0 improperly handles certain system calls, which allows remote attackers to cause a denial of service (DOS) via a specially-crafted certificate.

  32. 3.3CVE-2012-6655EPSS 0.4%

    An issue exists AccountService 0.6.37 in the user_change_password_authorized_cb() function in user.c which could let a local users obtain encrypted passwords.

  33. 8.1CVE-2012-2248EPSS 2.4%

    An issue was discovered in dhclient 4.3.1-6 due to an embedded path variable.

  34. 7.8CVE-2011-2187EPSS 0.5%

    xscreensaver before 5.14 crashes during activation and leaves the screen unlocked when in Blank Only Mode and when DPMS is disabled, which allows local attackers to access resources without authentication.

  35. 6.1CVE-2016-1000110EPSS 4.5%

    The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a CGI script, which could allow a remote attacker to redirect HTTP requests.

  36. 9.8CVE-2019-19330EPSS 4.0%

    The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.

  37. 8.8CVE-2019-10220EPSS 5.1%

    Linux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in directory entry lists.

  38. 9.8CVE-2019-14896EPSS 8.7%

    A heap-based buffer overflow vulnerability was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. A remote attacker could cause a denial of service (system crash) or, possibly execute arbitrary code, when the lb…

  39. 9.8CVE-2011-1939ExploitEPSS 3.9%

    SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASCII-compatible encodings in conjunction PDO_MySql in PHP before 5.3.6.

  40. 4.3CVE-2011-1934EPSS 1.0%

    lilo-uuid-diskid causes lilo.conf to be world-readable in lilo 23.1.

  41. 8.1CVE-2019-16255EPSS 4.2%

    Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an …

  42. 5.3CVE-2019-16254EPSS 4.6%

    Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split…

  43. 7.5CVE-2019-16201EPSS 5.1%

    WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the I…

  44. 7.5CVE-2019-18679EPSS 41%

    An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is vulnerable to information disclosure when processing HTTP Digest Authentication. Nonce tokens contain the raw byte value of a pointer t…

  45. 5.3CVE-2019-18678EPSS 6.2%

    An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests through frontend software to a Squid instance that splits the HTTP Request pipeline differently. The resulting Response messages corrupt…

  46. 7.5CVE-2019-18676EPSS 9.2%

    An issue was discovered in Squid 3.x and 4.x through 4.8. Due to incorrect input validation, there is a heap-based buffer overflow that can result in Denial of Service to all clients using the proxy. Severity is high due to this vulnerabil…

  47. 9.8CVE-2019-12526EPSS 20%

    An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow. When receiving data from a remote server in response to an URN request, Squid fails to ensure that the response can fit …

  48. 9.1CVE-2019-12523EPSS 4.3%

    An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HTTP request doesn't go through the access checks that incoming HTTP requests go through. This causes all access checks to…

  49. 6.5CVE-2011-4350ExploitEPSS 16%

    Yaws 1.91 has a directory traversal vulnerability in the way certain URLs are processed. A remote authenticated user could use this flaw to obtain content of arbitrary local files via specially-crafted URL request.

  50. 9.8CVE-2011-4120EPSS 2.0%

    Yubico PAM Module before 2.10 performed user authentication when 'use_first_pass' PAM configuration option was not used and the module was configured as 'sufficient' in the PAM configuration. A remote attacker could use this flaw to circum…