VYPR
← Debian

Vendor CVEs

Debian

All CVEs

3,338 total · sorted by risk
  • CVE-2014-4207Jul 17, 2014
    MariaDB
    MariaDB
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier allows remote authenticated users to affect availability via vectors related to SROPTZR.

  • CVE-2014-2494Jul 17, 2014
    MariaDB
    MariaDB
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier allows remote authenticated users to affect availability via vectors related to ENARC.

  • CVE-2014-2490Jul 17, 2014
    Microfocus
    Hpux
    risk 0.00cvss —epss 0.06

    Unspecified vulnerability in the Java SE component in Oracle Java SE 7u60 and SE 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

  • CVE-2014-2483Jul 17, 2014
    Openjdk
    OpenJDK
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in the Java SE component in Oracle Java SE Java SE 7u60 and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-4223. NOTE: the…

  • CVE-2014-4699Jul 9, 2014
    Linux
    Kernel
    risk 0.00cvss —epss 0.02

    The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use IRET, which allows local users to leverage a race condition and gain privileges, or cause a denial…

  • CVE-2014-3487Jul 9, 2014
    PHP
    PHP
    risk 0.00cvss —epss 0.15

    The cdf_read_property_info function in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate a stream offset, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF…

  • CVE-2014-3479Jul 9, 2014
    PHP
    PHP
    risk 0.00cvss —epss 0.15

    The cdf_check_stream_offset function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, relies on incorrect sector-size data, which allows remote attackers to cause a denial of service (application crash) via a crafted…

  • CVE-2014-4721Jul 6, 2014
    PHP
    PHP
    risk 0.00cvss —epss 0.06

    The phpinfo implementation in ext/standard/info.c in PHP before 5.4.30 and 5.5.x before 5.5.14 does not ensure use of the string data type for the PHP_AUTH_PW, PHP_AUTH_TYPE, PHP_AUTH_USER, and PHP_SELF variables, which might allow context-dependent attackers to obtain sensitive…

  • CVE-2014-3538Jul 3, 2014
    File Project
    File
    risk 0.00cvss —epss 0.12

    file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule. NOTE: this vulnerability…

  • CVE-2014-4667Jul 3, 2014
    Linux
    Kernel
    risk 0.00cvss —epss 0.06

    The sctp_association_free function in net/sctp/associola.c in the Linux kernel before 3.15.2 does not properly manage a certain backlog value, which allows remote attackers to cause a denial of service (socket outage) via a crafted SCTP packet.

  • CVE-2014-4617Jun 25, 2014
    Gnupg
    Gnupg
    risk 0.00cvss —epss 0.03

    The do_uncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24 allows context-dependent attackers to cause a denial of service (infinite loop) via malformed compressed packets, as demonstrated by an a3 01 5b ff byte sequence.

  • CVE-2014-4049Jun 18, 2014
    PHP
    PHP
    risk 0.00cvss —epss 0.11

    Heap-based buffer overflow in the php_parserr function in ext/standard/dns.c in PHP 5.6.0beta4 and earlier allows remote servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DNS TXT record, related to the dns_get_record function.

  • CVE-2014-0478Jun 17, 2014
    Debian
    Apt
    risk 0.00cvss —epss 0.02

    APT before 1.0.4 does not properly validate source packages, which allows man-in-the-middle attackers to download and install Trojan horse packages by removing the Release signature.

  • CVE-2014-3469Jun 5, 2014
    GNU
    Libtasn1
    risk 0.00cvss —epss 0.04

    The (1) asn1_read_value_type and (2) asn1_read_value functions in GNU Libtasn1 before 3.6 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via a NULL value in an ivalue argument.

  • CVE-2014-3468Jun 5, 2014
    GNU
    Libtasn1
    risk 0.00cvss —epss 0.04

    The asn1_get_bit_der function in GNU Libtasn1 before 3.6 does not properly report an error when a negative bit length is identified, which allows context-dependent attackers to cause out-of-bounds access via crafted ASN.1 data.

  • CVE-2014-0238Jun 1, 2014
    PHP
    PHP
    risk 0.00cvss —epss 0.21

    The cdf_read_property_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (infinite loop or out-of-bounds memory access) via a vector that (1) has zero length or (2) is too long.

  • CVE-2014-0237Jun 1, 2014
    PHP
    PHP
    risk 0.00cvss —epss 0.20

    The cdf_unpack_summary_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (performance degradation) by triggering many file_printf calls.

  • CVE-2014-3864May 30, 2014
    Debian
    Dpkg Dev
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in dpkg-source in dpkg-dev 1.3.0 allows remote attackers to modify files outside of the intended directories via a crafted source package that lacks a --- header line.

  • CVE-2014-3227May 30, 2014
    Debian
    Dpkg
    risk 0.00cvss —epss 0.02

    dpkg 1.15.9, 1.16.x before 1.16.14, and 1.17.x before 1.17.9 expect the patch program to be compliant with a need for the "C-style encoded filenames" feature, but is supported in environments with noncompliant patch programs, which triggers an interaction error that allows…

  • CVE-2014-3730May 16, 2014
    Djangoproject
    Django
    risk 0.00cvss —epss 0.03

    The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by…

  • CVE-2014-3127May 14, 2014
    Debian
    Dpkg
    risk 0.00cvss —epss 0.02

    dpkg 1.15.9 on Debian squeeze introduces support for the "C-style encoded filenames" feature without recognizing that the squeeze patch program lacks this feature, which triggers an interaction error that allows remote attackers to conduct directory traversal attacks and modify…

  • CVE-2014-3145May 11, 2014
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The BPF_S_ANC_NLATTR_NEST extension implementation in the sk_run_filter function in net/core/filter.c in the Linux kernel through 3.14.3 uses the reverse order in a certain subtraction, which allows local users to cause a denial of service (over-read and system crash) via…

  • CVE-2014-3144May 11, 2014
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The (1) BPF_S_ANC_NLATTR and (2) BPF_S_ANC_NLATTR_NEST extension implementations in the sk_run_filter function in net/core/filter.c in the Linux kernel through 3.14.3 do not check whether a certain length value is sufficiently large, which allows local users to cause a denial of…

  • CVE-2014-3122May 11, 2014
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The try_to_unmap_cluster function in mm/rmap.c in the Linux kernel before 3.14.3 does not properly consider which pages must be locked, which allows local users to cause a denial of service (system crash) by triggering a memory-usage pattern that requires removal of page-table…

  • CVE-2014-1738May 11, 2014
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The raw_cmd_copyout function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly restrict access to certain pointers during processing of an FDRAWCMD ioctl call, which allows local users to obtain sensitive information from kernel heap memory by…

  • CVE-2014-1737May 11, 2014
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The raw_cmd_copyin function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly handle error conditions during processing of an FDRAWCMD ioctl call, which allows local users to trigger kfree operations and gain privileges by leveraging write access to…

  • CVE-2014-2891May 7, 2014
    Strongswan
    Strongswan
    risk 0.00cvss —epss 0.02

    strongSwan before 5.1.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a crafted ID_DER_ASN1_DN ID payload.

  • CVE-2014-0469May 5, 2014
    Debian
    Xbuffy
    risk 0.00cvss —epss 0.03

    Stack-based buffer overflow in a certain Debian patch for xbuffy before 3.3.bl.3.dfsg-9 allows remote attackers to execute arbitrary code via the subject of an email, possibly related to indent subject lines.

  • CVE-2014-0471Apr 30, 2014
    Debian
    Dpkg
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in the unpacking functionality in dpkg before 1.15.9, 1.16.x before 1.16.13, and 1.17.x before 1.17.8 allows remote attackers to write arbitrary files via a crafted source package, related to "C-style filename quoting."

  • CVE-2013-4565Apr 25, 2014
    Debian
    Ppthtml
    risk 0.00cvss —epss 0.03

    Heap-based buffer overflow in the __OLEdecode function in ppthtml 0.5.1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted .ppt file.

  • CVE-2014-2983Apr 23, 2014
    Drupal
    Drupal
    risk 0.00cvss —epss 0.02

    Drupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the cached data of different anonymous users, which allows remote anonymous users to obtain sensitive interim form input information in opportunistic situations via unspecified vectors.

  • CVE-2014-2709Apr 23, 2014
    Cacti (software)
    Cacti
    risk 0.00cvss —epss 0.05

    lib/rrd.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified parameters.

  • CVE-2014-2328Apr 23, 2014
    Cacti (software)
    Cacti
    risk 0.00cvss —epss 0.04

    lib/graph_export.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in unspecified vectors.

  • CVE-2014-2327Apr 23, 2014
    Cacti (software)
    Cacti
    risk 0.00cvss —epss 0.02

    Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary…

  • CVE-2014-2427Apr 16, 2014
    Sun Corporation
    Java SE
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Sound.

  • CVE-2014-2423Apr 16, 2014
    Sun Corporation
    Java SE
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS, a different vulnerability than CVE-2014-0452 and CVE-2014-0458.

  • CVE-2014-2414Apr 16, 2014
    Sun Corporation
    Java SE
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAXB.

  • CVE-2014-2412Apr 16, 2014
    Sun Corporation
    Java SE
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, SE 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT, a different vulnerability than CVE-2014-0451.

  • CVE-2014-2403Apr 16, 2014
    Sun Corporation
    Java SE
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality via vectors related to JAXP.

  • CVE-2014-2398Apr 16, 2014
    Sun Corporation
    Java SE
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JavaFX 2.2.51; and JRockit R27.8.1 and R28.3.1 allows remote authenticated users to affect integrity via unknown vectors related to Javadoc.

  • CVE-2014-2397Apr 16, 2014
    Sun Corporation
    Java SE
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

  • CVE-2014-0461Apr 16, 2014
    IBM
    Forms Viewer
    risk 0.00cvss —epss 0.06

    Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

  • CVE-2014-0460Apr 16, 2014
    Sun Corporation
    Java SE
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality and integrity via vectors related to JNDI.

  • CVE-2014-0459Apr 16, 2014
    Sun Corporation
    Java SE
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect availability via unknown vectors related to 2D.

  • CVE-2014-0458Apr 16, 2014
    Sun Corporation
    Java SE
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS, a different vulnerability than CVE-2014-0452 and CVE-2014-2423.

  • CVE-2014-0453Apr 16, 2014
    Juniper Networks
    Junos Space
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Security.

  • CVE-2014-0452Apr 16, 2014
    Oracle Corporation
    Java SE Embedded
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS, a different vulnerability than CVE-2014-0458 and CVE-2014-2423.

  • CVE-2014-0451Apr 16, 2014
    Oracle Corporation
    Java SE Embedded
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT, a different vulnerability than CVE-2014-2412.

  • CVE-2014-0446Apr 16, 2014
    Oracle Corporation
    Java SE Embedded
    risk 0.00cvss —epss 0.06

    Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

  • CVE-2012-0214Apr 15, 2014
    Advanced Package Tool
    Advanced Package Tool
    risk 0.00cvss —epss 0.01

    The pkgAcqMetaClearSig::Failed method in apt-pkg/acquire-item.cc in Advanced Package Tool (APT) 0.8.11 through 0.8.15.10 and 0.8.16 before 0.8.16~exp13, when updating from repositories that use InRelease files, allows man-in-the-middle attackers to install arbitrary packages by…

Page 53 of 67