Debian
Page 45 of 100 — Debian CVEs from a corpus of 10223, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-13396 | High | 7.1 | 2020-05-22 | An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in ntlm_read_ChallengeMessage in winpr/libwinpr/ss… |
CVE-2020-11077 | Medium | 6.8 | 2020-05-22 | In Puma (RubyGem) before 4.3.5 and 3.12.6, a client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown clien… |
CVE-2020-11076 | High | 7.5 | 2020-05-22 | In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed… |
CVE-2020-10711 | Medium | 5.9 | 2020-05-22 | A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw occurs while importing the Commercial IP Se… |
CVE-2020-12693 | High | 8.1 | 2020-05-21 | Slurm 19.05.x before 19.05.7 and 20.02.x before 20.02.3, in the rare case where Message Aggregation is enabled, allows Authentication Bypass via an Alternate P… |
CVE-2020-13113 | High | 8.2 | 2020-05-21 | An issue was discovered in libexif before 0.6.22. Use of uninitialized memory in EXIF Makernote handling could lead to crashes and potential use-after-free con… |
CVE-2020-13112 | Critical | 9.1 | 2020-05-21 | An issue was discovered in libexif before 0.6.22. Several buffer over-reads in EXIF MakerNote handling could lead to information disclosure and crashes. This i… |
CVE-2020-6491 | Medium | 6.5 | 2020-05-21 | Insufficient data validation in site information in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to spoof security UI via a crafted domain nam… |
CVE-2020-6490 | Medium | 4.3 | 2020-05-21 | Insufficient data validation in loader in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had been able to write to disk to leak cross-origin… |
CVE-2020-6489 | Medium | 4.3 | 2020-05-21 | Inappropriate implementation in developer tools in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had convinced the user to take certain act… |
CVE-2020-6488 | Medium | 4.3 | 2020-05-21 | Insufficient policy enforcement in downloads in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted H… |
CVE-2020-6487 | Medium | 6.5 | 2020-05-21 | Insufficient policy enforcement in downloads in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted H… |
CVE-2020-6486 | Medium | 6.5 | 2020-05-21 | Insufficient policy enforcement in navigations in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted… |
CVE-2020-6485 | Medium | 6.5 | 2020-05-21 | Insufficient data validation in media router in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had compromised the renderer process to bypas… |
CVE-2020-6484 | Medium | 6.5 | 2020-05-21 | Insufficient data validation in ChromeDriver in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted r… |
CVE-2020-6483 | Medium | 6.5 | 2020-05-21 | Insufficient policy enforcement in payments in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted HT… |
CVE-2020-6482 | Medium | 6.5 | 2020-05-21 | Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious exten… |
CVE-2020-6481 | Medium | 6.5 | 2020-05-21 | Insufficient policy enforcement in URL formatting in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to perform domain spoofing via a crafted dom… |
CVE-2020-6480 | Medium | 6.5 | 2020-05-21 | Insufficient policy enforcement in enterprise in Google Chrome prior to 83.0.4103.61 allowed a local attacker to bypass navigation restrictions via UI actions. |
CVE-2020-6479 | Medium | 6.5 | 2020-05-21 | Inappropriate implementation in sharing in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to spoof security UI via a crafted HTML page. |
CVE-2020-6478 | Medium | 6.5 | 2020-05-21 | Inappropriate implementation in full screen in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to spoof security UI via a crafted HTML page. |
CVE-2020-6476 | Medium | 6.5 | 2020-05-21 | Insufficient policy enforcement in tab strip in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious extension t… |
CVE-2020-6475 | Medium | 6.5 | 2020-05-21 | Incorrect implementation in full screen in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to spoof security UI via a crafted HTML page. |
CVE-2020-6474 | High | 8.8 | 2020-05-21 | Use after free in Blink in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6473 | Medium | 6.5 | 2020-05-21 | Insufficient policy enforcement in Blink in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to obtain potentially sensitive information from proc… |
CVE-2020-6472 | Medium | 6.5 | 2020-05-21 | Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious exten… |
CVE-2020-6471 | Critical | 9.6 | 2020-05-21 | Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious exten… |
CVE-2020-6470 | Medium | 6.1 | 2020-05-21 | Insufficient validation of untrusted input in clipboard in Google Chrome prior to 83.0.4103.61 allowed a local attacker to inject arbitrary scripts or HTML (UX… |
CVE-2020-6469 | Critical | 9.6 | 2020-05-21 | Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious exten… |
CVE-2020-6468 | High | 8.8 | 2020-05-21 | Type confusion in V8 in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6467 | High | 8.8 | 2020-05-21 | Use after free in WebRTC in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6466 | Critical | 9.6 | 2020-05-21 | Use after free in media in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sand… |
CVE-2020-6465 | Critical | 9.6 | 2020-05-21 | Use after free in reader mode in Google Chrome on Android prior to 83.0.4103.61 allowed a remote attacker who had compromised the renderer process to potential… |
CVE-2020-6464 | High | 8.8 | 2020-05-21 | Type confusion in Blink in Google Chrome prior to 81.0.4044.138 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6463 | High | 8.8 | 2020-05-21 | Use after free in ANGLE in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6462 | Critical | 9.6 | 2020-05-21 | Use after free in task scheduling in Google Chrome prior to 81.0.4044.129 allowed a remote attacker who had compromised the renderer process to potentially per… |
CVE-2020-6461 | Critical | 9.6 | 2020-05-21 | Use after free in storage in Google Chrome prior to 81.0.4044.129 allowed a remote attacker who had compromised the renderer process to potentially perform a s… |
CVE-2020-6460 | Medium | 6.5 | 2020-05-21 | Insufficient data validation in URL formatting in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to perform domain spoofing via a crafted domai… |
CVE-2020-6459 | High | 8.8 | 2020-05-21 | Use after free in payments in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6458 | High | 8.8 | 2020-05-21 | Out of bounds read and write in PDFium in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially exploit heap corruption via a crafted P… |
CVE-2020-6457 | Critical | 9.6 | 2020-05-21 | Use after free in speech recognizer in Google Chrome prior to 81.0.4044.113 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTM… |
CVE-2020-9484 | High | 7.0 | 2020-05-20 | When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the con… |
CVE-2020-11078 | Medium | 6.8 | 2020-05-20 | In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send addi… |
CVE-2020-13230 | Medium | 4.3 | 2020-05-20 | In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that account (e.g., permission to view logs). |
CVE-2020-13164 | High | 7.5 | 2020-05-19 | In Wireshark 3.2.0 to 3.2.3, 3.0.0 to 3.0.10, and 2.6.0 to 2.6.16, the NFS dissector could crash. This was addressed in epan/dissectors/packet-nfs.c by prevent… |
CVE-2020-10995 | High | 7.5 | 2020-05-19 | PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplification attacks. An issue in the DNS protocol has been found… |
CVE-2020-8021 | Medium | 5.3 | 2020-05-19 | a Improper Access Control vulnerability in of Open Build Service allows remote attackers to read files of an OBS package where the sourceaccess/access is disab… |
CVE-2020-8617 | High | 7.5 | 2020-05-19 | Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesse… |
CVE-2020-8616 | High | 8.6 | 2020-05-19 | A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the us… |
CVE-2020-12663 | High | 7.5 | 2020-05-19 | Unbound before 1.10.1 has an infinite loop via malformed DNS answers received from upstream servers. |
CVE-2020-12662 | High | 7.5 | 2020-05-19 | Unbound before 1.10.1 has Insufficient Control of Network Message Volume, aka an "NXNSAttack" issue. This is triggered by random subdomains in the NSDNAME in N… |
CVE-2020-12244 | High | 7.5 | 2020-05-19 | An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in the answer section of a NXDOMAIN response lacking an SOA were not properly va… |
CVE-2020-13143 | Medium | 6.5 | 2020-05-18 | gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c in the Linux kernel 3.16 through 5.6.13 relies on kstrdup without considering the possibility of an… |
CVE-2020-12888 | Medium | 5.3 | 2020-05-15 | The VFIO PCI driver in the Linux kernel through 5.6.13 mishandles attempts to access disabled memory space. |
CVE-2020-11526 | Low | 2.2 | 2020-05-15 | libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read. |
CVE-2020-11525 | Low | 2.2 | 2020-05-15 | libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read. |
CVE-2020-11523 | Medium | 6.6 | 2020-05-15 | libfreerdp/gdi/region.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Integer Overflow. |
CVE-2020-11522 | Medium | 6.5 | 2020-05-15 | libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read. |
CVE-2020-11521 | Medium | 6.6 | 2020-05-15 | libfreerdp/codec/planar.c in FreeRDP version > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write. |
CVE-2018-10756 | High | 7.8 | 2020-05-15 | Use-after-free in libtransmission/variant.c in Transmission before 3.00 allows remote attackers to cause a denial of service (crash) or possibly execute arbitr… |
CVE-2020-3810 | Medium | 5.5 | 2020-05-15 | Missing input validation in the ar/tar implementations of APT before version 2.1.2 could result in denial of service when processing specially crafted deb file… |
CVE-2020-0093 | Medium | 5.0 | 2020-05-14 | In exif_data_save_data_entry of exif-data.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclos… |
CVE-2020-8020 | Medium | 6.5 | 2020-05-13 | A Improper Neutralization of Input During Web Page Generation vulnerability in open-build-service allows remote attackers to store arbitrary JS code to cause X… |
CVE-2020-3341 | High | 7.5 | 2020-05-13 | A vulnerability in the PDF archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.101 - 0.102.2 could allow an unauthenticated, remote attacker… |
CVE-2020-3327 | High | 7.5 | 2020-05-13 | A vulnerability in the ARJ archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.102.2 could allow an unauthenticated, remote attacker to cause… |
CVE-2020-11058 | Low | 2.2 | 2020-05-12 | In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could lead to a later out-of-bounds read. As a result, a man… |
CVE-2020-1746 | Medium | 5.0 | 2020-05-12 | A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible… |
CVE-2020-12823 | Critical | 9.8 | 2020-05-12 | OpenConnect 8.09 has a buffer overflow, causing a denial of service (application crash) or possibly unspecified other impact, via crafted certificate data to g… |
CVE-2020-8159 | Critical | 9.8 | 2020-05-12 | There is a vulnerability in actionpack_page-caching gem < v1.2.1 that allows an attacker to write arbitrary files to a web server, potentially resulting in rem… |
CVE-2020-12783 | High | 7.5 | 2020-05-11 | Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c. |
CVE-2020-10685 | Medium | 5.0 | 2020-05-11 | A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Towe… |
CVE-2020-12771 | Medium | 5.5 | 2020-05-09 | An issue was discovered in the Linux kernel through 5.6.11. btree_gc_coalesce in drivers/md/bcache/btree.c has a deadlock if a coalescing operation fails. |
CVE-2020-12770 | Medium | 6.7 | 2020-05-09 | An issue was discovered in the Linux kernel through 5.6.11. sg_write lacks an sg_remove_request call in a certain failure case, aka CID-83c6f2390040. |
CVE-2020-12769 | Medium | 5.5 | 2020-05-09 | An issue was discovered in the Linux kernel before 5.4.17. drivers/spi/spi-dw.c allows attackers to cause a panic via concurrent calls to dw_spi_irq and dw_spi… |
CVE-2020-12768 | Medium | 5.5 | 2020-05-09 | An issue was discovered in the Linux kernel before 5.6. svm_cpu_uninit in arch/x86/kvm/svm.c has a memory leak, aka CID-d80b64ff297e. NOTE: third parties dispu… |
CVE-2020-12767 | Medium | 5.5 | 2020-05-09 | exif_entry_get_value in exif-entry.c in libexif 0.6.21 has a divide-by-zero error. |
CVE-2020-12762 | High | 7.8 | 2020-05-09 | json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend. |
CVE-2020-10690 | Medium | 6.5 | 2020-05-08 | There is a use-after-free in kernel versions before 5.5 due to a race condition between the release of ptp_clock and cdev while resource deallocation. When a (… |
CVE-2020-11049 | Medium | 5.5 | 2020-05-07 | In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read of client memory that is then passed on to the protocol parser. This has been patched in 2… |
CVE-2020-11048 | Low | 2.2 | 2020-05-07 | In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session. No data extraction is possible. This has been fixed i… |
CVE-2020-11047 | Medium | 5.5 | 2020-05-07 | In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in autodetect_recv_bandwidth_measure_results. A malicious server can extract up to 8 byte… |
CVE-2020-11046 | Medium | 5.5 | 2020-05-07 | In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize that could lead to a later out-of-bounds read. |
CVE-2020-11045 | Low | 2.2 | 2020-05-07 | In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that allows client memory to be read to an image buffer. The… |
CVE-2020-11044 | Low | 2.2 | 2020-05-07 | In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes the client application if corrupted data from a manipu… |
CVE-2020-11042 | Medium | 5.5 | 2020-05-07 | In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It allows reading a attacker-defined amount of client me… |
CVE-2020-12108 | Medium | 6.5 | 2020-05-06 | /options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection. |
CVE-2020-10704 | High | 7.5 | 2020-05-06 | A flaw was found when using samba as an Active Directory Domain Controller. Due to the way samba handles certain requests as an Active Directory Domain Control… |
CVE-2020-12672 | High | 7.5 | 2020-05-06 | GraphicsMagick through 1.3.35 has a heap-based buffer overflow in ReadMNGImage in coders/png.c. |
CVE-2020-12653 | High | 7.8 | 2020-05-05 | An issue was found in Linux kernel before 5.5.4. The mwifiex_cmd_append_vsie_tlv() function in drivers/net/wireless/marvell/mwifiex/scan.c allows local users t… |
CVE-2020-10933 | Medium | 5.3 | 2020-05-04 | An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, except… |
CVE-2020-12626 | Medium | 6.5 | 2020-05-04 | An issue was discovered in Roundcube Webmail before 1.4.4. A CSRF attack can cause an authenticated user to be logged out because POST was not considered. |
CVE-2020-12625 | Medium | 6.1 | 2020-05-04 | An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting (XSS) vulnerability in rcube_washtml.php because JavaScript code can… |
CVE-2020-11030 | Medium | 6.4 | 2020-04-30 | In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the block editor. This… |
CVE-2020-11029 | Medium | 5.8 | 2020-04-30 | In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) at… |
CVE-2020-11028 | Medium | 5.8 | 2020-04-30 | In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specific set of condition… |
CVE-2020-11027 | Medium | 6.1 | 2020-04-30 | In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be needed to the email… |
CVE-2020-11026 | High | 8.7 | 2020-04-30 | In affected versions of WordPress, files with a specially crafted name when uploaded to the Media section can lead to script execution upon accessing the file… |
CVE-2020-11025 | Medium | 5.8 | 2020-04-30 | In affected versions of WordPress, a cross-site scripting (XSS) vulnerability in the navigation section of Customizer allows JavaScript code to be executed. Ex… |
CVE-2020-1752 | High | 7.0 | 2020-04-30 | A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing a… |
CVE-2020-11652 | Medium | 6.5 | 2020-04-30 | An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that i… |