[ Vendor · 36 CVEs ]
Debian
CVEs affecting Debian published in the last 30 days, plus any Debian CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2023-7101 | 24 Dec 2023 | CVSS 7.8 | Spreadsheet::ParseExcel Remote Code ExecutionSpreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code… | ExploitedFix |
| CVE-2023-43770 | 22 Sep 2023 | CVSS 6.1 | Roundcube Webmail Persistent Cross-Site Scripting (XSS)Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of… | ExploitedFix |
| CVE-2023-41993 | 21 Sep 2023 | CVSS 8.8 | Apple Multiple Products WebKit Code ExecutionThe issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution… | Exploited |
| CVE-2023-4762 | 5 Sep 2023 | CVSS 8.8 | Google Chromium V8 Type ConfusionType Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium… | ExploitedFix |
| CVE-2022-30333 | 9 May 2022 | CVSS 7.5 | RARLAB UnRAR Directory TraversalRARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by… | ExploitedFix |
| CVE-2022-0543 | 18 Feb 2022 | CVSS 10.0 | Debian-specific Redis Server Lua Sandbox EscapeIt was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which… | ExploitedFix |
| CVE-2021-44026 | 19 Nov 2021 | CVSS 9.8 | Roundcube Webmail SQL InjectionRoundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params. | ExploitedFix |
| CVE-2021-3156 | 26 Jan 2021 | CVSS 7.8 | Sudo Heap-Based Buffer OverflowSudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via… | ExploitedFix |
| CVE-2020-36193 | 18 Jan 2021 | CVSS 7.5 | PEAR Archive_Tar Improper Link ResolutionTar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue… | ExploitedFix |
| CVE-2020-35730 | 28 Dec 2020 | CVSS 6.1 | Roundcube Webmail Cross-Site Scripting (XSS)An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text… | ExploitedFix |
| CVE-2020-28949 | 19 Nov 2020 | CVSS 7.8 | PEAR Archive_Tar Deserialization of Untrusted DataArchive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to… | Exploited |
| CVE-2020-16846 | 6 Nov 2020 | CVSS 9.8 | SaltStack Salt Shell InjectionAn issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in… | Exploited |
| CVE-2020-11651 | 30 Apr 2020 | CVSS 9.8 | SaltStack Salt Authentication BypassAn issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate… | Exploited |
| CVE-2020-11652 | 30 Apr 2020 | CVSS 6.5 | SaltStack Salt Path TraversalAn issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some… | Exploited |
| CVE-2020-7247 | 29 Jan 2020 | CVSS 9.8 | OpenSMTPD Remote Code Executionsmtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as… | ExploitedFix |
| CVE-2019-16928 | 27 Sep 2019 | CVSS 9.8 | Exim Out-of-bounds WriteExim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in… | ExploitedFix |
| CVE-2019-13272 | 17 Jul 2019 | CVSS 7.8 | Linux Kernel Improper Privilege ManagementIn the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a… | ExploitedFix |
| CVE-2018-6789 | 8 Feb 2018 | CVSS 9.8 | Exim Buffer OverflowAn issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may… | ExploitedFix |
| CVE-2017-16651 | 9 Nov 2017 | CVSS 7.8 | Roundcube Webmail File DisclosureRoundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem… | ExploitedFix |
| CVE-2017-8291 | 27 Apr 2017 | CVSS 7.8 | Artifex Ghostscript Type ConfusionArtifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%"… | ExploitedFix |
| CVE-2016-5195 | 10 Nov 2016 | CVSS 7.0 | Linux Kernel Race ConditionRace condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of… | ExploitedFix |
| CVE-2016-3714 | 5 May 2016 | CVSS 8.4 | ImageMagick Improper Input ValidationThe (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1… | ExploitedFix |
| CVE-2016-3427 | 21 Apr 2016 | CVSS 9.8 | Oracle Java SE and JRockit UnspecifiedUnspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect… | ExploitedFix |
| CVE-2016-1646 | 29 Mar 2016 | CVSS 8.8 | Google Chromium V8 Out-of-Bounds ReadThe Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider… | ExploitedFix |
| CVE-2016-0752 | 16 Feb 2016 | CVSS 7.5 | Ruby on Rails Directory TraversalDirectory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x… | Exploited |
| CVE-2015-5477 | 29 Jul 2015 | CVSS 7.5 | Crafted TKEY queries crash ISC BIND DNS serversnamed in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and… | ExploitedFix |
| CVE-2015-2590 | 16 Jul 2015 | CVSS 9.8 | Oracle Java SE and Java SE Embedded Remote Code ExecutionUnspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect… | ExploitedFix |
| CVE-2015-3306 | 18 May 2015 | CVSS 10.0 | ProFTPD mod_copy lets anyone copy files on the serverThe mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. | Exploited |
| CVE-2014-0196 | 7 May 2014 | CVSS 5.5 | Linux Kernel Race ConditionThe n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST"… | ExploitedFix |
| CVE-2013-1690 | 26 Jun 2013 | CVSS 8.8 | Mozilla Firefox and Thunderbird Denial-of-ServiceMozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle… | Exploited |
| CVE-2013-1675 | 16 May 2013 | CVSS 6.5 | Mozilla Firefox Information DisclosureMozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly… | Exploited |
| CVE-2012-0507 | 7 Jun 2012 | CVSS 9.8 | Oracle Java SE Runtime Environment (JRE) Arbitrary Code ExecutionUnspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0… | Exploited |
| CVE-2012-1823 | 11 May 2012 | CVSS 9.8 | PHP-CGI Query String Parametersapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query… | ExploitedFix |
| CVE-2010-4344 | 14 Dec 2010 | CVSS 9.8 | Exim Heap-Based Buffer OverflowHeap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an… | ExploitedFix |
| CVE-2010-4345 | 14 Dec 2010 | CVSS 7.8 | Exim Privilege EscalationExim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration… | ExploitedFix |
| CVE-2009-1151 | 26 Mar 2009 | CVSS 9.8 | phpMyAdmin Remote Code ExecutionStatic code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject… | ExploitedFix |