Debian: >> Debian Linux >> 10.0 Security Vulnerabilities
Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message.
CVSS Score
8.8
EPSS Score
0.03
Published
2019-11-07
OpenTTD before 1.1.5 contains a Denial of Service (slow read attack) that prevents users from joining the server.
CVSS Score
4.3
EPSS Score
0.013
Published
2019-11-07
Tahoe-LAFS 1.9.0 fails to ensure integrity which allows remote attackers to corrupt mutable files or directories upon retrieval.
CVSS Score
7.4
EPSS Score
0.017
Published
2019-11-07
DjVuLibre 3.5.27 has a NULL pointer dereference in the function DJVU::filter_fv at IW44EncodeCodec.cpp.
CVSS Score
7.5
EPSS Score
0.037
Published
2019-11-07
simplesamlphp before 1.6.3 (squeeze) and before 1.8.2 (sid) incorrectly handles XML encryption which could allow remote attackers to decrypt or forge messages.
CVSS Score
7.5
EPSS Score
0.007
Published
2019-11-06
There is a possible heap overflow in libclamav/fsg.c before 0.100.0.
CVSS Score
9.8
EPSS Score
0.015
Published
2019-11-06
archivemail 0.6.2 uses temporary files insecurely leading to a possible race condition.
CVSS Score
8.1
EPSS Score
0.009
Published
2019-11-06
The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.
CVSS Score
5.9
EPSS Score
0.08
Published
2019-11-05
Multiple CSRF issues in Horde Groupware Webmail Edition 5.1.2 and earlier in basic.php.
CVSS Score
6.5
EPSS Score
0.021
Published
2019-11-05
Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents
CVSS Score
6.5
EPSS Score
0.021
Published
2019-11-05