|
2017-04-27
|
CVE-2017-8291
|
Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.
|
Ghostscript, Debian_linux, Enterprise_linux_desktop, Enterprise_linux_eus, Enterprise_linux_server, Enterprise_linux_server_aus, Enterprise_linux_server_tus, Enterprise_linux_workstation
|
7.8
|
|
|
|
2020-01-29
|
CVE-2020-7247
|
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.
|
Ubuntu_linux, Debian_linux, Fedora, Opensmtpd
|
9.8
|
|
|
|
2019-07-17
|
CVE-2019-13272
|
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor...
|
Ubuntu_linux, Debian_linux, Fedora, Linux_kernel, Active_iq_unified_manager, Aff_a700s_firmware, E\-Series_performance_analyzer, E\-Series_santricity_os_controller, H410c_firmware, H610s_firmware, Hci_compute_node, Hci_management_node, Service_processor, Solidfire, Steelstore_cloud_integrated_storage, Enterprise_linux, Enterprise_linux_for_arm_64, Enterprise_linux_for_ibm_z_systems, Enterprise_linux_for_real_time, Enterprise_linux_for_real_time_for_nfv, Enterprise_linux_for_real_time_for_nfv_tus, Enterprise_linux_for_real_time_tus
|
7.8
|
|
|
|
2021-01-18
|
CVE-2020-36193
|
Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
|
Debian_linux, Drupal, Fedora, Archive_tar
|
7.5
|
|
|
|
2023-04-24
|
CVE-2023-29469
|
An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\0' value).
|
Debian_linux, Libxml2
|
6.5
|
|
|
|
2021-12-10
|
CVE-2021-44228
|
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along...
|
Log4j, Xcode, Synchro, Synchro_4d, Advanced_malware_protection_virtual_private_cloud_appliance, Automated_subsea_tuning, Broadworks, Business_process_automation, Cloud_connect, Cloudcenter, Cloudcenter_cost_optimizer, Cloudcenter_suite, Cloudcenter_suite_admin, Cloudcenter_workload_manager, Common_services_platform_collector, Connected_analytics_for_network_deployment, Connected_mobile_experiences, Contact_center_domain_manager, Contact_center_management_portal, Crosswork_data_gateway, Crosswork_network_automation, Crosswork_network_controller, Crosswork_optimization_engine, Crosswork_platform_infrastructure, Crosswork_zero_touch_provisioning, Customer_experience_cloud_agent, Cx_cloud_agent, Cyber_vision, Cyber_vision_sensor_management_extension, Data_center_network_manager, Dna_center, Dna_spaces, Dna_spaces\:_connector, Dna_spaces_connector, Emergency_responder, Enterprise_chat_and_email, Evolved_programmable_network_manager, Finesse, Firepower_threat_defense, Fog_director, Fxos, Identity_services_engine, Integrated_management_controller_supervisor, Intersight_virtual_appliance, Iot_operations_dashboard, Mobility_services_engine, Network_assurance_engine, Network_dashboard_fabric_controller, Network_insights_for_data_center, Network_services_orchestrator, Nexus_dashboard, Nexus_insights, Optical_network_controller, Packaged_contact_center_enterprise, Paging_server, Prime_service_catalog, Sd\-Wan_vmanage, Smart_phy, Ucs_central, Ucs_central_software, Ucs_director, Unified_communications_manager, Unified_communications_manager_im_\&_presence_service, Unified_communications_manager_im_and_presence_service, Unified_computing_system, Unified_contact_center_enterprise, Unified_contact_center_express, Unified_contact_center_management_portal, Unified_customer_voice_portal, Unified_intelligence_center, Unified_sip_proxy, Unified_workforce_optimization, Unity_connection, Video_surveillance_manager, Video_surveillance_operations_manager, Virtual_topology_system, Virtualized_infrastructure_manager, Virtualized_voice_browser, Wan_automation_engine, Webex_meetings_server, Workload_optimization_manager, Debian_linux, Fedora, Audio_development_kit, Computer_vision_annotation_tool, Data_center_manager, Genomics_kernel_library, Oneapi_sample_browser, Secure_device_onboard, Sensor_solution_firmware_development_kit, System_debugger, System_studio, Active_iq_unified_manager, Cloud_insights, Cloud_manager, Cloud_secure_agent, Oncommand_insight, Ontap_tools, Snapcenter, Rhythmyx, Captial, Comos, Desigo_cc_advanced_reports, Desigo_cc_info_center, E\-Car_operation_center, Energy_engage, Energyip, Energyip_prepay, Gma\-Manager, Head\-End_system_universal_device_integration_system, Industrial_edge_management, Industrial_edge_management_hub, Logo\!_soft_comfort, Mendix, Mindsphere, Navigator, Nx, Opcenter_intelligence, Operation_scheduler, Sentron_powermanager, Siguard_dsa, Sipass_integrated, Siveillance_command, Siveillance_control_pro, Siveillance_identity, Siveillance_vantage, Siveillance_viewpoint, Solid_edge_cam_pro, Solid_edge_harness_design, Spectrum_power_4, Spectrum_power_7, Sppa\-T3000_ses3000_firmware, Teamcenter, Vesys, Xpedition_enterprise, Xpedition_package_integrator, Snow_commander, Vm_access_proxy, Email_security
|
10.0
|
|
|
|
2020-04-30
|
CVE-2020-11652
|
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.
|
Workspaces_server, Ubuntu_linux, Debian_linux, Leap, Salt, Application_remote_collector
|
6.5
|
|
|
|
2021-03-09
|
CVE-2021-21166
|
Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
|
Debian_linux, Fedora, Chrome
|
8.8
|
|
|
|
2021-11-19
|
CVE-2021-44026
|
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
|
Debian_linux, Fedora, Webmail
|
9.8
|
|
|
|
2021-12-15
|
CVE-2021-0920
|
In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel
|
Debian_linux, Android
|
6.4
|
|
|