Overview 23 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 1 EPSS ≥ 0.5
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
23
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
23
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
23
100.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
0
0.0%
split by
peak 3 / year
19991
Not applicable1
High1
not blocked1
Working exploit published1
20003
Not applicable3
High1
Medium2
not blocked3
Working exploit published3
20011
Not applicable1
High1
not blocked1
Working exploit published1
20021
Not applicable1
Medium1
not blocked1
Working exploit published1
20032
Not applicable2
High1
Medium1
not blocked2
Working exploit published2
20040
20052
Not applicable2
Low2
not blocked2
Working exploit published2
20061
Not applicable1
Medium1
not blocked1
Working exploit published1
20072
Not applicable2
Medium1
Low1
not blocked2
Working exploit published2
20082
Not applicable2
High1
Medium1
not blocked2
Working exploit published2
20091
Not applicable1
Medium1
not blocked1
Working exploit published1
20100
20111
Not applicable1
High1
not blocked1
Working exploit published1
20120
20130
20140
20150
20161
Not applicable1
High1
not blocked1
Working exploit published1
20172
Not applicable2
High1
Medium1
not blocked2
Working exploit published2
20182
Not applicable2
High1
Medium1
not blocked2
Working exploit published2
20190
20201
Not applicable1
Medium1
not blocked1
Working exploit published1
20002002200420062008201020122014201620182020
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2012-1096 | Medium | 2020-03-10 | Not applicable | Working exploit published | NetworkManager 0.9 and earlier allows local users to use other users' certificates or private keys when making a connection via the file path when adding a new connection. |
| CVE-2018-15120 | Medium | 2018-08-24 | Not applicable | Working exploit published | libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted text with invalid Unicode sequences. |
| CVE-2018-10900 | High | 2018-07-26 | Not applicable | Working exploit published | Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a privilege escalation attack. A new line character can be used to inject a Password helper parameter into the configuration data passed to VPNC, allowing an attacker to execute arbitrary commands as root. |
| CVE-2017-1000083 | High | 2017-09-05 | Not applicable | Working exploit published | backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a "--" command-line option substring, as demonstrated by a --checkpoint-action=exec=bash at the beginning of the filename. |
| CVE-2017-8871 | Medium | 2017-06-12 | Not applicable | Working exploit published | The cr_parser_parse_selector_core function in cr-parser.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted CSS file. |
| CVE-2016-6855 | High | 2016-09-07 | Not applicable | Working exploit published | Eye of GNOME (aka eog) 3.16.5, 3.17.x, 3.18.x before 3.18.3, 3.19.x, and 3.20.x before 3.20.4, when used with glib before 2.44.1, allow remote attackers to cause a denial of service (out-of-bounds write and crash) via vectors involving passing invalid UTF-8 to GMarkup. |
| CVE-2011-0020 | High | 2011-01-24 | Not applicable | Working exploit published | Heap-based buffer overflow in the pango_ft2_font_render_box_glyph function in pango/pangoft2-render.c in libpango in Pango 1.28.3 and earlier, when the FreeType2 backend is enabled, allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file, related to the glyph box for an FT_Bitmap object. |
| CVE-2008-7185 | Medium | 2009-09-08 | Not applicable | Working exploit published | GNOME Rhythmbox 0.11.5 allows remote attackers to cause a denial of service (segmentation fault and crash) via a playlist (.pls) file with a long Title field, possibly related to the g_hash_table_lookup function in b-playlist-manager.c. |
| CVE-2008-5660 | Medium | 2008-12-17 | Not applicable | Working exploit published | Format string vulnerability in the vinagre_utils_show_error function (src/vinagre-utils.c) in Vinagre 0.5.x before 0.5.2 and 2.x before 2.24.2 might allow remote attackers to execute arbitrary code via format string specifiers in a crafted URI or VNC server response. |
| CVE-2008-3533 | High | 2008-08-18 | Not applicable | Working exploit published | Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after 2.19.90 and before 2.24 allows remote attackers to execute arbitrary code via format string specifiers in an invalid URI on the command line, as demonstrated by use of yelp within (1) man or (2) ghelp URI handlers in Firefox, Evolution, and unspecified other programs. |
| CVE-2007-1266 | Medium | 2007-03-06 | Not applicable | Working exploit published | Evolution 2.8.1 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Evolution from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message without detection. |
| CVE-2007-0010 | Low | 2007-01-24 | Not applicable | Working exploit published | The GdkPixbufLoader function in GIMP ToolKit (GTK+) in GTK 2 (gtk2) before 2.4.13 allows context-dependent attackers to cause a denial of service (crash) via a malformed image file. |
| CVE-2006-0528 | Medium | 2006-02-02 | Not applicable | Working exploit published | The cairo library (libcairo), as used in GNOME Evolution and possibly other products, allows remote attackers to cause a denial of service (persistent client crash) via an attached text file that contains "Content-Disposition: inline" in the header, and a very long line in the body, which causes the client to repeatedly crash until the e-mail message is manually removed, possibly due to a buffer overflow, as demonstrated using an XML attachment. |
| CVE-2005-0023 | Low | 2005-10-05 | Not applicable | Working exploit published | gnome-pty-helper in GNOME libzvt2 and libvte4 allows local users to spoof the logon hostname via a modified DISPLAY environment variable. NOTE: the severity of this issue has been disputed. |
| CVE-2005-1686 | Low | 2005-05-20 | Not applicable | Working exploit published | Format string vulnerability in gedit 2.10.2 may allow attackers to cause a denial of service (application crash) via a bin file with format string specifiers in the filename. NOTE: while this issue is triggered on the command line by the gedit user, it has been reported that web browsers and email clients could be configured to provide a file name as an argument to gedit, so there is a valid attack that crosses security boundaries. |
| CVE-2003-0407 | High | 2003-06-30 | Not applicable | Working exploit published | Buffer overflow in gbnserver for Gnome Batalla Naval 1.0.4 allows remote attackers to execute arbitrary code via a long connection string. |
| CVE-2003-0165 | Medium | 2003-04-02 | Not applicable | Working exploit published | Format string vulnerability in Eye Of Gnome (EOG) allows attackers to execute arbitrary code via format string specifiers in a command line argument for the file to display. |
| CVE-2002-1814 | Medium | 2002-12-31 | Not applicable | Working exploit published | Buffer overflow in efstools in Bonobo, when installed setuid, allows local users to execute arbitrary code via long command line arguments. |
| CVE-2001-0084 | High | 2001-02-12 | Not applicable | Working exploit published | GTK+ library allows local users to specify arbitrary modules via the GTK_MODULES environmental variable, which could allow local users to gain privileges if GTK+ is used by a setuid/setgid program. |
| CVE-2000-0864 | Medium | 2000-11-14 | Not applicable | Working exploit published | Race condition in the creation of a Unix domain socket in GNOME esound 0.2.19 and earlier allows a local user to change the permissions of arbitrary files and directories, and gain additional privileges, via a symlink attack. |
| CVE-2000-0504 | Medium | 2000-06-19 | Not applicable | Working exploit published | libICE in XFree86 allows remote attackers to cause a denial of service by specifying a large value which is not properly checked by the SKIP_STRING macro. |
| CVE-2000-0491 | High | 2000-05-24 | Not applicable | Working exploit published | Buffer overflow in the XDMCP parsing code of GNOME gdm, KDE kdm, and wdm allows remote attackers to execute arbitrary commands or cause a denial of service via a long FORWARD_QUERY request. |
| CVE-1999-1477 | High | 1999-09-23 | Not applicable | Working exploit published | Buffer overflow in GNOME libraries 1.0.8 allows local user to gain root access via a long --espeaker argument in programs such as nethack. |