Debian Linux vulnerabilities

CVE-2015-8613 [MEDIUM] CWE-787 CVE-2015-8613: Stack-based buffer overflow in the megasas_ctrl_get_info function in QEMU, when built with SCSI Mega Stack-based buffer overflow in the megasas_ctrl_get_info function in QEMU, when built with SCSI MegaRAID SAS HBA emulation support, allows local guest users to cause a denial of service (QEMU instance crash) via a crafted SCSI controller CTRL_GET_INFO command.

CVE-2013-7370 [MEDIUM] CWE-79 CVE-2013-7370: node-connect before 2.8.1 has XSS in the Sencha Labs Connect middleware node-connect before 2.8.1 has XSS in the Sencha Labs Connect middleware

CVE-2020-15563 [MEDIUM] CWE-119 CVE-2020-15563: An issue was discovered in Xen through 4.13.x, allowing x86 HVM guest OS users to cause a hypervisor An issue was discovered in Xen through 4.13.x, allowing x86 HVM guest OS users to cause a hypervisor crash. An inverted conditional in x86 HVM guests' dirty video RAM tracking code allows such guests to make Xen de-reference a pointer guaranteed to point at unmapped space. A malicious or buggy HVM guest may cause the hypervisor to crash, resulting i

CVE-2020-15564 [MEDIUM] CWE-119 CVE-2020-15564: An issue was discovered in Xen through 4.13.x, allowing Arm guest OS users to cause a hypervisor cra An issue was discovered in Xen through 4.13.x, allowing Arm guest OS users to cause a hypervisor crash because of a missing alignment check in VCPUOP_register_vcpu_info. The hypercall VCPUOP_register_vcpu_info is used by a guest to register a shared region with the hypervisor. The region will be mapped into Xen address space so it can be directly ac

CVE-2021-45086 [MEDIUM] CWE-79 CVE-2021-45086: XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's sugges XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's suggested_filename is used as the pdf_name value in PDF.js.

CVE-2020-1951 [MEDIUM] CWE-835 CVE-2020-1951: A carefully crafted or corrupt PSD file can cause an infinite loop in Apache Tika's PSDParser in ver A carefully crafted or corrupt PSD file can cause an infinite loop in Apache Tika's PSDParser in versions 1.0-1.23.

CVE-2020-29568 [MEDIUM] CWE-770 CVE-2020-29568: An issue was discovered in Xen through 4.14.x. Some OSes (such as Linux, FreeBSD, and NetBSD) are pr An issue was discovered in Xen through 4.14.x. Some OSes (such as Linux, FreeBSD, and NetBSD) are processing watch events using a single thread. If the events are received faster than the thread is able to handle, they will get queued. As the queue is unbounded, a guest may be able to trigger an OOM in the backend. All systems with a FreeBSD, Linux,

CVE-2021-28713 [MEDIUM] CVE-2021-28713: Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relate Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen offers the ability to run PV backends in regular unprivileged guests, typically referred to as "driver domains". Running PV backends in driver domains has one pr

CVE-2021-28711 [MEDIUM] CVE-2021-28711: Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relate Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen offers the ability to run PV backends in regular unprivileged guests, typically referred to as "driver domains". Running PV backends in driver domains has one pr

CVE-2021-28712 [MEDIUM] CVE-2021-28712: Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relate Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen offers the ability to run PV backends in regular unprivileged guests, typically referred to as "driver domains". Running PV backends in driver domains has one pr

CVE-2021-0089 [MEDIUM] CWE-203 CVE-2021-0089: Observable response discrepancy in some Intel(R) Processors may allow an authorized user to potentia Observable response discrepancy in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.

CVE-2017-5938 [MEDIUM] CWE-79 CVE-2017-5938: Cross-site scripting (XSS) vulnerability in the nav_path function in lib/viewvc.py in ViewVC before Cross-site scripting (XSS) vulnerability in the nav_path function in lib/viewvc.py in ViewVC before 1.0.14 and 1.1.x before 1.1.26 allows remote attackers to inject arbitrary web script or HTML via the nav_data name.

CVE-2019-12471 [MEDIUM] CWE-79 CVE-2019-12471: Wikimedia MediaWiki 1.30.0 through 1.32.1 has XSS. Loading user JavaScript from a non-existent accou Wikimedia MediaWiki 1.30.0 through 1.32.1 has XSS. Loading user JavaScript from a non-existent account allows anyone to create the account, and perform XSS on users loading that script. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.

CVE-2022-42334 [MEDIUM] CVE-2022-42334: x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To allow cachability control for HVM guests with passed through devices, an interface exists to explicitly override defaults which would otherwise be put in place. While not exposed to t

CVE-2019-2537 [MEDIUM] CVE-2019-2537: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported v Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.6.42 and prior, 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerabili

CVE-2013-4158 [MEDIUM] CVE-2013-4158: smokeping before 2.6.9 has XSS (incomplete fix for CVE-2012-0790) smokeping before 2.6.9 has XSS (incomplete fix for CVE-2012-0790)

CVE-2014-4913 [MEDIUM] CWE-79 CVE-2014-4913: ZF2014-03 has a potential cross site scripting vector in multiple view helpers ZF2014-03 has a potential cross site scripting vector in multiple view helpers

CVE-2016-1652 [MEDIUM] CWE-79 CVE-2016-1652: Cross-site scripting (XSS) vulnerability in the ModuleSystem::RequireForJsInner function in extensio Cross-site scripting (XSS) vulnerability in the ModuleSystem::RequireForJsInner function in extensions/renderer/module_system.cc in the Extensions subsystem in Google Chrome before 50.0.2661.75 allows remote attackers to inject arbitrary web script or HTML via a crafted web site, aka "Universal XSS (UXSS)."

CVE-2012-3972 [MEDIUM] CWE-200 CVE-2012-3972: The format-number functionality in the XSLT implementation in Mozilla Firefox before 15.0, Firefox E The format-number functionality in the XSLT implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to obtain sensitive information via unspecified vectors that trigger a heap-based buffer over-read.

CVE-2022-28202 [MEDIUM] CWE-79 CVE-2022-28202: An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37 An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete.