Debian
Page 50 of 100 — Debian CVEs from a corpus of 10223, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-19830 | Medium | 6.5 | 2019-12-17 | _core_/plugins/medias in SPIP 3.2.x before 3.2.7 allows remote authenticated authors to inject content into the database. |
CVE-2019-16779 | Medium | 5.8 | 2019-12-16 | In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would… |
CVE-2019-19331 | High | 7.5 | 2019-12-16 | knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. DNS replies with very many resource records might be proces… |
CVE-2019-19783 | Medium | 6.5 | 2019-12-16 | An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed (3.x) or certain non-de… |
CVE-2014-8650 | Critical | 9.8 | 2019-12-15 | python-requests-Kerberos through 0.5 does not handle mutual authentication |
CVE-2014-8561 | Medium | 6.5 | 2019-12-15 | imagemagick 6.8.9.6 has remote DOS via infinite loop |
CVE-2014-4913 | Medium | 6.1 | 2019-12-15 | ZF2014-03 has a potential cross site scripting vector in multiple view helpers |
CVE-2019-19797 | Medium | 5.5 | 2019-12-15 | read_colordef in read.c in Xfig fig2dev 3.2.7b has an out-of-bounds write. |
CVE-2014-3495 | High | 7.5 | 2019-12-13 | duplicity 0.6.24 has improper verification of SSL certificates |
CVE-2014-2387 | Medium | 4.4 | 2019-12-13 | Pen 0.18.0 has Insecure Temporary File Creation vulnerabilities |
CVE-2014-0175 | Critical | 9.8 | 2019-12-13 | mcollective has a default password set at install |
CVE-2019-12420 | High | 7.5 | 2019-12-12 | In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recommended… |
CVE-2018-11805 | Medium | 6.7 | 2019-12-12 | In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injec… |
CVE-2019-18345 | Critical | 9.3 | 2019-12-12 | A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the… |
CVE-2019-17358 | High | 8.1 | 2019-12-12 | Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated… |
CVE-2019-19725 | Critical | 9.8 | 2019-12-11 | sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c. |
CVE-2019-19583 | High | 7.5 | 2019-12-11 | An issue was discovered in Xen through 4.12.x allowing x86 HVM/PVH guest OS users to cause a denial of service (guest OS crash) because VMX VMEntry checks mish… |
CVE-2013-7371 | Medium | 6.1 | 2019-12-11 | node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370) |
CVE-2013-7370 | Medium | 6.1 | 2019-12-11 | node-connect before 2.8.1 has XSS in the Sencha Labs Connect middleware |
CVE-2013-4245 | High | 7.3 | 2019-12-11 | Orca has arbitrary code execution due to insecure Python module load |
CVE-2013-4158 | Medium | 6.1 | 2019-12-11 | smokeping before 2.6.9 has XSS (incomplete fix for CVE-2012-0790) |
CVE-2019-19709 | Medium | 6.1 | 2019-12-11 | MediaWiki through 1.33.1 allows attackers to bypass the Title_blacklist protection mechanism by starting with an arbitrary title, establishing a non-resolvable… |
CVE-2019-5815 | High | 7.5 | 2019-12-11 | Type confusion in xsltNumberFormatGetMultipleLevel prior to libxslt 1.1.33 could allow attackers to potentially exploit heap corruption via crafted XML data. |
CVE-2019-19604 | High | 7.8 | 2019-12-11 | Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 becaus… |
CVE-2019-14889 | High | 8.8 | 2019-12-10 | A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp… |
CVE-2019-14870 | Medium | 5.4 | 2019-12-10 | All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delegation model includes… |
CVE-2019-14861 | Medium | 5.3 | 2019-12-10 | All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC pipe provides admi… |
CVE-2019-13764 | High | 8.8 | 2019-12-10 | Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-13763 | Medium | 4.3 | 2019-12-10 | Insufficient policy enforcement in payments in Google Chrome prior to 79.0.3945.79 allowed a remote attacker who had compromised the renderer process to leak c… |
CVE-2019-13762 | Low | 3.3 | 2019-12-10 | Insufficient policy enforcement in downloads in Google Chrome on Windows prior to 79.0.3945.79 allowed a local attacker to spoof downloaded files via local cod… |
CVE-2019-13761 | Medium | 4.3 | 2019-12-10 | Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted d… |
CVE-2019-13759 | Medium | 4.3 | 2019-12-10 | Incorrect security UI in interstitials in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
CVE-2019-13758 | Medium | 4.3 | 2019-12-10 | Insufficient policy enforcement in navigation in Google Chrome on Android prior to 79.0.3945.79 allowed a remote attacker to bypass navigation restrictions via… |
CVE-2019-13757 | Medium | 4.3 | 2019-12-10 | Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted d… |
CVE-2019-13756 | Medium | 4.3 | 2019-12-10 | Incorrect security UI in printing in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
CVE-2019-13755 | Medium | 4.3 | 2019-12-10 | Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to disable extensions via a crafted HTML page. |
CVE-2019-13754 | Medium | 4.3 | 2019-12-10 | Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass navigation restrictions via a crafted… |
CVE-2019-13753 | Medium | 6.5 | 2019-12-10 | Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2019-13752 | Medium | 6.5 | 2019-12-10 | Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2019-13751 | Medium | 6.5 | 2019-12-10 | Uninitialized data in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2019-13750 | Medium | 6.5 | 2019-12-10 | Insufficient data validation in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass defense-in-depth measures via a crafted HTML… |
CVE-2019-13749 | Medium | 6.5 | 2019-12-10 | Incorrect security UI in Omnibox in Google Chrome on iOS prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a c… |
CVE-2019-13748 | Medium | 6.5 | 2019-12-10 | Insufficient policy enforcement in developer tools in Google Chrome prior to 79.0.3945.79 allowed a local attacker to obtain potentially sensitive information… |
CVE-2019-13747 | High | 8.8 | 2019-12-10 | Uninitialized data in rendering in Google Chrome on Android prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafte… |
CVE-2019-13746 | Medium | 6.5 | 2019-12-10 | Insufficient policy enforcement in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via… |
CVE-2019-13745 | Medium | 6.5 | 2019-12-10 | Insufficient policy enforcement in audio in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2019-13744 | Medium | 6.5 | 2019-12-10 | Insufficient policy enforcement in cookies in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2019-13743 | Medium | 6.5 | 2019-12-10 | Incorrect security UI in external protocol handling in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to spoof security UI via a crafted HTML pa… |
CVE-2019-13742 | Medium | 6.5 | 2019-12-10 | Incorrect security UI in Omnibox in Google Chrome on iOS prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a c… |
CVE-2019-13741 | High | 8.8 | 2019-12-10 | Insufficient validation of untrusted input in Blink in Google Chrome prior to 79.0.3945.79 allowed a local attacker to bypass same origin policy via crafted cl… |
CVE-2019-13740 | Medium | 6.5 | 2019-12-10 | Incorrect security UI in sharing in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
CVE-2019-13739 | Medium | 6.5 | 2019-12-10 | Insufficient policy enforcement in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a… |
CVE-2019-13738 | Medium | 6.5 | 2019-12-10 | Insufficient policy enforcement in navigation in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass site isolation via a crafted HTML page. |
CVE-2019-13737 | Medium | 6.5 | 2019-12-10 | Insufficient policy enforcement in autocomplete in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information fr… |
CVE-2019-13736 | High | 8.8 | 2019-12-10 | Integer overflow in PDFium in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. |
CVE-2019-13735 | High | 8.8 | 2019-12-10 | Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTM… |
CVE-2019-13734 | High | 8.8 | 2019-12-10 | Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-13732 | High | 8.8 | 2019-12-10 | Use-after-free in WebAudio in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-13730 | High | 8.8 | 2019-12-10 | Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-13729 | High | 8.8 | 2019-12-10 | Use-after-free in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-13728 | High | 8.8 | 2019-12-10 | Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2019-13727 | High | 8.8 | 2019-12-10 | Insufficient policy enforcement in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass same origin policy via a crafted HTML… |
CVE-2019-13726 | High | 8.8 | 2019-12-10 | Buffer overflow in password manager in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted HTML page. |
CVE-2019-13725 | High | 8.8 | 2019-12-10 | Use-after-free in Bluetooth in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted HTML page. |
CVE-2012-1577 | Critical | 9.8 | 2019-12-10 | lib/libc/stdlib/random.c in OpenBSD returns 0 when seeded with 0. |
CVE-2016-1000108 | Medium | 6.1 | 2019-12-10 | yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of… |
CVE-2013-4184 | Medium | 5.5 | 2019-12-10 | Perl module Data::UUID from CPAN version 1.219 vulnerable to symlink attacks |
CVE-2013-4133 | High | 7.5 | 2019-12-10 | kde-workspace before 4.10.5 has a memory leak in plasma desktop |
CVE-2013-2167 | Critical | 9.8 | 2019-12-10 | python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass |
CVE-2013-2166 | Critical | 9.8 | 2019-12-10 | python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass |
CVE-2019-19630 | High | 7.8 | 2019-12-08 | HTMLDOC 1.9.7 allows a stack-based buffer overflow in the hd_strlcpy() function in string.c (when called from render_contents in ps-pdf.cxx) via a crafted HTML… |
CVE-2019-19448 | High | 7.8 | 2019-12-08 | In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to… |
CVE-2019-1551 | Medium | 5.3 | 2019-12-06 | There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis sugges… |
CVE-2012-2130 | High | 7.4 | 2019-12-06 | A Security Bypass vulnerability exists in PolarSSL 0.99pre4 through 1.1.1 due to a weak encryption error when generating Diffie-Hellman values and RSA keys. |
CVE-2019-19617 | Critical | 9.8 | 2019-12-06 | phpMyAdmin before 4.9.2 does not escape certain Git information, related to libraries/classes/Display/GitRevision.php and libraries/classes/Footer.php. |
CVE-2012-1115 | Medium | 6.1 | 2019-12-05 | A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the export, add_value_form, and dn parameters to cmd.php. |
CVE-2012-1114 | Medium | 6.1 | 2019-12-05 | A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the filter parameter to cmd.php in an export and exporter_id action… |
CVE-2019-16770 | Medium | 5.3 | 2019-12-05 | In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service atta… |
CVE-2012-1105 | Medium | 5.5 | 2019-12-05 | An Information Disclosure vulnerability exists in the Jasig Project php-pear-CAS 1.2.2 package in the /tmp directory. The Central Authentication Service client… |
CVE-2012-1104 | Medium | 5.3 | 2019-12-05 | A Security Bypass vulnerability exists in the phpCAS 1.2.2 library from the jasig project due to the way proxying of services are managed. |
CVE-2013-0326 | Medium | 5.5 | 2019-12-05 | OpenStack nova base images permissions are world readable |
CVE-2019-19553 | High | 7.5 | 2019-12-05 | In Wireshark 3.0.0 to 3.0.6 and 2.6.0 to 2.6.12, the CMS dissector could crash. This was addressed in epan/dissectors/asn1/cms/packet-cms-template.c by ensurin… |
CVE-2013-2745 | Critical | 9.8 | 2019-12-04 | An SQL Injection vulnerability exists in MiniDLNA prior to 1.1.0 |
CVE-2015-7542 | Medium | 5.3 | 2019-12-03 | A vulnerability exists in libgwenhywfar through 4.12.0 due to the usage of outdated bundled CA certificates. |
CVE-2013-7325 | High | 8.8 | 2019-12-03 | An issue exists in uscan in devscripts before 2.13.19, which could let a remote malicious user execute arbitrary code via a crafted tarball. |
CVE-2019-19536 | Medium | 4.6 | 2019-12-03 | In the Linux kernel before 5.2.9, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_pro.c dri… |
CVE-2019-19535 | Medium | 4.6 | 2019-12-03 | In the Linux kernel before 5.2.9, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_fd.c driv… |
CVE-2019-19534 | Low | 2.4 | 2019-12-03 | In the Linux kernel before 5.3.11, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_core.c d… |
CVE-2019-19531 | Medium | 6.8 | 2019-12-03 | In the Linux kernel before 5.2.9, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/yurex.c driver, aka CID-fc… |
CVE-2019-19530 | Medium | 4.6 | 2019-12-03 | In the Linux kernel before 5.2.10, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/class/cdc-acm.c driver, aka CI… |
CVE-2019-19527 | Medium | 6.8 | 2019-12-03 | In the Linux kernel before 5.2.10, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/hid/usbhid/hiddev.c driver, aka CI… |
CVE-2019-19525 | Medium | 4.6 | 2019-12-03 | In the Linux kernel before 5.3.6, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/net/ieee802154/atusb.c driver, aka… |
CVE-2019-19524 | Medium | 4.6 | 2019-12-03 | In the Linux kernel before 5.3.12, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/input/ff-memless.c driver, aka CID… |
CVE-2019-19523 | Medium | 4.6 | 2019-12-03 | In the Linux kernel before 5.3.7, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/adutux.c driver, aka CID-4… |
CVE-2013-4235 | Medium | 4.7 | 2019-12-03 | shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees |
CVE-2013-2106 | High | 7.5 | 2019-12-03 | webauth before 4.6.1 has authentication credential disclosure |
CVE-2012-4576 | High | 7.8 | 2019-12-02 | FreeBSD: Input Validation Flaw allows local users to gain elevated privileges |
CVE-2012-4428 | High | 7.5 | 2019-12-02 | openslp: SLPIntersectStringList()' Function has a DoS vulnerability |
CVE-2019-19479 | Medium | 5.5 | 2019-12-01 | An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-setcos.c has an incorrect read operation during parsing of a SET… |
CVE-2019-18609 | Critical | 9.8 | 2019-12-01 | An issue was discovered in amqp_handle_input in amqp_connection.c in rabbitmq-c 0.9.0. There is an integer overflow that leads to heap memory corruption in the… |