VYPR
← Debian

Vendor CVEs

Debian

All CVEs

10,437 total · sorted by risk
  • CVE-2012-0961Dec 26, 2012
    Ubuntu
    apt
    risk 0.00cvss —epss 0.00

    Apt 0.8.16~exp5ubuntu13.x before 0.8.16~exp5ubuntu13.6, 0.8.16~exp12ubuntu10.x before 0.8.16~exp12ubuntu10.7, and 0.9.7.5ubuntu5.x before 0.9.7.5ubuntu5.2, as used in Ubuntu, uses world-readable permissions for /var/log/apt/term.log, which allows local users to obtain sensitive…

  • CVE-2012-3515Nov 23, 2012
    QEMU
    Qemu
    risk 0.00cvss —epss 0.01

    Qemu, as used in Xen 4.0, 4.1 and possibly other products, when emulating certain devices with a virtual console backend, allows local OS guest users to gain privileges via a crafted escape VT100 sequence that triggers the overwrite of a "device model's address space."

  • CVE-2012-5842Nov 21, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allow remote attackers to cause a denial of service (memory…

  • CVE-2012-4216Nov 21, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    Use-after-free vulnerability in the gfxFont::GetFontEntry function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause…

  • CVE-2012-4207Nov 21, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    The HZ-GB-2312 character-set implementation in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 does not properly handle a ~ (tilde) character in proximity to a chunk delimiter,…

  • CVE-2012-4201Nov 21, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    The evalInSandbox implementation in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 uses an incorrect context during the handling of JavaScript code that sets the location.href…

  • CVE-2012-4533Nov 19, 2012
    Viewvc
    Viewvc
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the "extra" details in the DiffSource._get_row function in lib/viewvc.py in ViewVC 1.0.x before 1.0.13 and 1.1.x before 1.1.16 allows remote authenticated users with repository commit access to inject arbitrary web script or HTML via…

  • CVE-2012-3197Oct 17, 2012
    MariaDB
    MariaDB
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.64 and earlier, and 5.5.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Replication.

  • CVE-2012-3180Oct 17, 2012
    MariaDB
    MariaDB
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.65 and earlier, and 5.5.27 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.

  • CVE-2012-3177Oct 17, 2012
    MariaDB
    MariaDB
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.65 and earlier, and 5.5.27 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server.

  • CVE-2012-3173Oct 17, 2012
    MariaDB
    MariaDB
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.63 and earlier, and 5.5.25 and earlier, allows remote authenticated users to affect availability via unknown vectors related to InnoDB Plugin.

  • CVE-2012-3167Oct 17, 2012
    MariaDB
    MariaDB
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.63 and earlier, and 5.5.25 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Full Text Search.

  • CVE-2012-3166Oct 17, 2012
    MariaDB
    MariaDB
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.63 and earlier, and 5.5.25 and earlier, allows remote authenticated users to affect availability via unknown vectors related to InnoDB.

  • CVE-2012-3163Oct 17, 2012
    MariaDB
    MariaDB
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.64 and earlier, and 5.5.26 and earlier, allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Information Schema.

  • CVE-2012-3160Oct 16, 2012
    MariaDB
    MariaDB
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.65 and earlier, and 5.5.27 and earlier, allows local users to affect confidentiality via unknown vectors related to Server Installation.

  • CVE-2012-3158Oct 16, 2012
    MariaDB
    MariaDB
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.64 and earlier, and 5.5.26 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Protocol.

  • CVE-2012-3150Oct 16, 2012
    MariaDB
    MariaDB
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.64 and earlier, and 5.5.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.

  • CVE-2012-4430Oct 10, 2012
    Bacula
    Bacula
    risk 0.00cvss —epss 0.03

    The dump_resource function in dird/dird_conf.c in Bacula before 5.2.11 does not properly enforce ACL rules, which allows remote authenticated users to obtain resource dump information via unspecified vectors.

  • CVE-2012-4182Oct 10, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Use-after-free vulnerability in the nsTextEditRules::WillInsert function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or…

  • CVE-2012-4179Oct 10, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Use-after-free vulnerability in the nsHTMLCSSUtils::CreateCSSPropertyTxn function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary…

  • CVE-2012-3990Oct 10, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Use-after-free vulnerability in the IME State Manager implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via…

  • CVE-2012-3986Oct 10, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 do not properly restrict calls to DOMWindowUtils (aka nsDOMWindowUtils) methods, which allows remote attackers to bypass intended…

  • CVE-2012-3982Oct 10, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allow remote attackers to cause a denial of service (memory…

  • CVE-2012-3500Oct 1, 2012
    Devscripts Devel Team
    Devscripts
    risk 0.00cvss —epss 0.00

    scripts/annotate-output.sh in devscripts before 2.12.2, as used in rpmdevtools before 8.3, allows local users to modify arbitrary files via a symlink attack on the temporary (1) standard output or (2) standard error output file.

  • CVE-2012-2240Oct 1, 2012
    Devscripts Devel Team
    Devscripts
    risk 0.00cvss —epss 0.03

    scripts/dscverify.pl in devscripts before 2.12.3 allows remote attackers to execute arbitrary commands via unspecified vectors related to "arguments to external commands."

  • CVE-2012-1183Sep 18, 2012
    Asterisk
    Asterisk
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in the milliwatt_generate function in the Miliwatt application in Asterisk 1.4.x before 1.4.44, 1.6.x before 1.6.2.23, 1.8.x before 1.8.10.1, and 10.x before 10.2.1, when the o option is used and the internal_timing option is off, allows remote…

  • CVE-2012-4929Sep 15, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.04

    The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by…

  • CVE-2012-4388Sep 7, 2012
    PHP
    PHP
    risk 0.00cvss —epss 0.04

    The sapi_header_op function in main/SAPI.c in PHP 5.4.0RC2 through 5.4.0 does not properly determine a pointer during checks for %0D sequences (aka carriage return characters), which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted…

  • CVE-2012-3527Sep 5, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    view_help.php in the backend help system in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to unserialize arbitrary objects and possibly execute arbitrary PHP code via an unspecified parameter, related to a…

  • CVE-2012-3509Sep 5, 2012
    GNU
    Binutils
    risk 0.00cvss —epss 0.04

    Multiple integer overflows in the (1) _objalloc_alloc function in objalloc.c and (2) objalloc_alloc macro in include/objalloc.h in GNU libiberty, as used by binutils 2.22, allow remote attackers to cause a denial of service (crash) via vectors related to the "addition of…

  • CVE-2012-3972Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    The format-number functionality in the XSLT implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to obtain sensitive information via…

  • CVE-2012-3959Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Use-after-free vulnerability in the nsRangeUpdater::SelAdjDeleteNode function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code…

  • CVE-2012-1975Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    Use-after-free vulnerability in the PresShell::CompleteMove function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause…

  • CVE-2012-1974Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    Use-after-free vulnerability in the gfxTextRun::CanBreakLineBefore function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or…

  • CVE-2012-1973Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    Use-after-free vulnerability in the nsObjectLoadingContent::LoadObject function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary…

  • CVE-2012-1972Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    Use-after-free vulnerability in the nsHTMLEditor::CollapseAdjacentTextNodes function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute…

  • CVE-2012-1970Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allow remote attackers to cause a denial of service (memory…

  • CVE-2012-2387Aug 20, 2012
    Debian
    Devotee
    risk 0.00cvss —epss 0.01

    devotee 0.1 patch 2 uses a 32-bit seed for generating 48-bit random numbers, which makes it easier for remote attackers to obtain the secret monikers via a brute force attack.

  • CVE-2012-2750Aug 17, 2012
    MySQL
    MySQL
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in MySQL 5.5.x before 5.5.23 has unknown impact and attack vectors related to a "Security Fix", aka Bug #59533. NOTE: this might be a duplicate of CVE-2012-1689, but as of 20120816, Oracle has not commented on this possibility.

  • CVE-2012-2135Aug 14, 2012
    Python (programming language)
    Python
    risk 0.00cvss —epss 0.05

    The utf-16 decoder in Python 3.1 through 3.3 does not update the aligned_end variable after calling the unicode_decode_call_errorhandler function, which allows remote attackers to obtain sensitive information (process memory) or cause a denial of service (memory corruption and…

  • CVE-2012-3425Aug 13, 2012
    Libpng
    Libpng
    risk 0.00cvss —epss 0.03

    The png_push_read_zTXt function in pngpread.c in libpng 1.0.x before 1.0.58, 1.2.x before 1.2.48, 1.4.x before 1.4.10, and 1.5.x before 1.5.10 allows remote attackers to cause a denial of service (out-of-bounds read) via a large avail_in field value in a PNG image.

  • CVE-2012-3453Aug 7, 2012
    Logol
    logol
    risk 0.00cvss —epss 0.00

    logol 1.5.0 uses world writable permissions for the /var/lib/logol/results directory, which allows local users to delete or overwrite arbitrary files.

  • CVE-2012-2317Aug 7, 2012
    PHP
    PHP
    risk 0.00cvss —epss 0.02

    The Debian php_crypt_revamped.patch patch for PHP 5.3.x, as used in the php5 package before 5.3.3-7+squeeze4 in Debian GNU/Linux squeeze, the php5 package before 5.3.2-1ubuntu4.17 in Ubuntu 10.04 LTS, and the php5 package before 5.3.5-1ubuntu7.10 in Ubuntu 11.04, does not…

  • CVE-2012-3867Aug 6, 2012
    Puppet (software)
    Puppet
    risk 0.00cvss —epss 0.02

    lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote…

  • CVE-2012-3954Jul 25, 2012
    Isc
    DHCP
    risk 0.00cvss —epss 0.04

    Multiple memory leaks in ISC DHCP 4.1.x and 4.2.x before 4.2.4-P1 and 4.1-ESV before 4.1-ESV-R6 allow remote attackers to cause a denial of service (memory consumption) by sending many requests.

  • CVE-2012-4048Jul 24, 2012
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.01

    The PPP dissector in Wireshark 1.4.x before 1.4.14, 1.6.x before 1.6.9, and 1.8.x before 1.8.1 allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via a crafted packet, as demonstrated by a usbmon dump.

  • CVE-2012-2751Jul 22, 2012
    Trustwave
    Modsecurity
    risk 0.00cvss —epss 0.03

    ModSecurity before 2.6.6, when used with PHP, does not properly handle single quotes not at the beginning of a request parameter value in the Content-Disposition field of a request with a multipart/form-data Content-Type header, which allows remote attackers to bypass filtering…

  • CVE-2012-0867Jul 18, 2012
    PostgreSQL
    PostgreSQL
    risk 0.00cvss —epss 0.02

    PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, which allows remote attackers to spoof connections when the host name is exactly 32 characters.

  • CVE-2012-2351Jul 12, 2012
    Mahara (software)
    Mahara
    risk 0.00cvss —epss 0.02

    The default configuration of the auth/saml plugin in Mahara before 1.4.2 sets the "Match username attribute to Remote username" option to false, which allows remote SAML IdP servers to spoof users of other SAML IdP servers by using the same internal username.

  • CVE-2012-2143Jul 5, 2012
    PHP
    PHP
    risk 0.00cvss —epss 0.06

    The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if this password contains a 0x80 character, which makes it easier for context-dependent attackers to…

Page 199 of 209