Overview 31 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 3 public PoC · 0 EPSS ≥ 0.5
31matches
0in Waratek scope0.0%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
3public PoC9.7%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
31
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
31
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
3
9.7%
Proof of concept only
1
3.2%
Forecast only
0
0.0%
No public exploit
27
87.1%
split by
peak 5 / year
19991
Not applicable1
Low1
not blocked1
No public exploit1
20000
20010
20020
20033
Not applicable3
Low3
not blocked3
No public exploit3
20040
20052
Not applicable2
Low2
not blocked2
Working exploit published2
20065
Not applicable5
Low5
not blocked5
No public exploit5
20073
Not applicable3
Low3
not blocked3
Working exploit published1
No public exploit2
20080
20092
Not applicable2
Low2
not blocked2
No public exploit2
20100
20112
Not applicable2
Low2
not blocked2
No public exploit2
20125
Not applicable5
Low5
not blocked5
No public exploit5
20130
20142
Not applicable2
Low2
not blocked2
No public exploit2
20150
20161
Not applicable1
Low1
not blocked1
No public exploit1
20170
20180
20191
Not applicable1
Low1
not blocked1
No public exploit1
20201
Not applicable1
Low1
not blocked1
No public exploit1
20212
Not applicable2
Low2
not blocked2
Proof of concept only1
No public exploit1
20220
20230
20240
20251
Not applicable1
Low1
not blocked1
No public exploit1
200120042007201020132016201920222025
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2025-6199 | Low | 2025-06-17 | Not applicable | No public exploit | A flaw was found in the GIF parser of GdkPixbuf’s LZW decoder. When an invalid symbol is encountered during decompression, the decoder sets the reported output size to the full buffer length rather than the actual number of written bytes. This logic error results in uninitialized sections of the buffer being included in the output, potentially leaking arbitrary memory contents in the processed image. |
| CVE-2020-36314 | Low | 2021-04-07 | Not applicable | No public exploit | fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for CVE-2020-11736. |
| CVE-2021-3349 | Low | 2021-02-01 | Not applicable | Proof of concept only | GNOME Evolution through 3.38.3 produces a "Valid signature" message for an unknown identifier on a previously trusted key because Evolution does not retrieve enough information from the GnuPG API. NOTE: third parties dispute the significance of this issue, and dispute whether Evolution is the best place to change this behavior |
| CVE-2020-11736 | Low | 2020-04-13 | Not applicable | No public exploit | fr-archive-libarchive.c in GNOME file-roller through 3.36.1 allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink to a directory outside of the intended extraction location. |
| CVE-2016-1000002 | Low | 2019-11-05 | Not applicable | No public exploit | gdm3 3.14.2 and possibly later has an information leak before screen lock |
| CVE-2016-1000033 | Low | 2016-10-25 | Not applicable | No public exploit | Shotwell version 0.22.0 (and possibly other versions) is vulnerable to a TLS/SSL certification validation flaw resulting in a potential for man in the middle attacks. |
| CVE-2011-2198 | Low | 2014-05-21 | Not applicable | No public exploit | The "insert-blank-characters" capability in caps.c in gnome-terminal (vte) before 0.28.1 allows remote authenticated users to cause a denial of service (CPU and memory consumption and crash) via a crafted file, as demonstrated by a file containing the string "\033[100000000000000000@". |
| CVE-2013-7273 | Low | 2014-04-29 | Not applicable | No public exploit | GNOME Display Manager (gdm) 3.4.1 and earlier, when disable-user-list is set to true, allows local users to cause a denial of service (unable to login) by pressing the cancel button after entering a user name. |
| CVE-2010-2387 | Low | 2012-12-21 | Not applicable | No public exploit | vicious-extensions/ve-misc.c in GNOME Display Manager (gdm) 2.20.x before 2.20.11, when GDM debug is enabled, logs the user password when it contains invalid UTF8 encoded characters, which might allow local users to gain privileges by reading the information from syslog logs. |
| CVE-2012-3378 | Low | 2012-08-31 | Not applicable | No public exploit | The register_application function in atk-adaptor/bridge.c in GNOME at-spi2-atk 2.5.2 does not seed the random number generator and generates predictable temporary file names, which makes it easier for local users to create or truncate files via a symlink attack on a temporary socket file in /tmp/at-spi2. |
| CVE-2012-3452 | Low | 2012-08-07 | Not applicable | No public exploit | gnome-screensaver 3.4.x before 3.4.4 and 3.5.x before 3.5.4, when multiple screens are used, only locks the screen with the active focus, which allows physically proximate attackers to bypass screen locking and access an unattended workstation. |
| CVE-2012-3355 | Low | 2012-07-17 | Not applicable | No public exploit | (1) AlbumTab.py, (2) ArtistTab.py, (3) LinksTab.py, and (4) LyricsTab.py in the Context module in GNOME Rhythmbox 0.13.3 and earlier allows local users to execute arbitrary code via a symlink attack on a temporary HTML template file in the /tmp/context directory. |
| CVE-2012-0948 | Low | 2012-06-07 | Not applicable | No public exploit | DistUpgrade/DistUpgradeMain.py in Update Manager, as used by Ubuntu 12.04 LTS, 11.10, and 11.04, uses weak permissions for (1) apt-clone_system_state.tar.gz and (2) system_state.tar.gz, which allows local users to obtain repository credentials. |
| CVE-2011-2176 | Low | 2011-09-02 | Not applicable | No public exploit | GNOME NetworkManager before 0.8.6 does not properly enforce the auth_admin element in PolicyKit, which allows local users to bypass intended wireless network sharing restrictions via unspecified vectors. |
| CVE-2011-1943 | Low | 2011-06-14 | Not applicable | No public exploit | The destroy_one_secret function in nm-setting-vpn.c in libnm-util in the NetworkManager package 0.8.999-3.git20110526 in Fedora 15 creates a log entry containing a certificate password, which allows local users to obtain sensitive information by reading a log file. |
| CVE-2009-4145 | Low | 2009-12-23 | Not applicable | No public exploit | nm-connection-editor in NetworkManager (NM) 0.7.x exports connection objects over D-Bus upon actions in the connection editor GUI, which allows local users to obtain sensitive information by reading D-Bus signals, as demonstrated by using dbus-monitor to discover the password for the WiFi network. |
| CVE-2009-1631 | Low | 2009-05-14 | Not applicable | No public exploit | The Mailer component in Evolution 2.26.1 and earlier uses world-readable permissions for the .evolution directory, and certain directories and files under .evolution/ related to local mail, which allows local users to obtain sensitive information by reading these files. |
| CVE-2007-6389 | Low | 2007-12-17 | Not applicable | No public exploit | The notify feature in GNOME screensaver (gnome-screensaver) 2.20.0 might allow local users to read the clipboard contents and X selection data for a locked session by using ctrl-V. |
| CVE-2007-3381 | Low | 2007-08-07 | Not applicable | No public exploit | The GDM daemon in GNOME Display Manager (GDM) before 2.14.13, 2.16.x before 2.16.7, 2.18.x before 2.18.4, and 2.19.x before 2.19.5 does not properly handle NULL return values from the g_strsplit function, which allows local users to cause a denial of service (persistent daemon crash) via a crafted command to the daemon's socket, related to (1) gdm.c and (2) gdmconfig.c in daemon/, and (3) gdmconfig.c and (4) gdmflexiserver.c in gui/. |
| CVE-2007-0010 | Low | 2007-01-24 | Not applicable | Working exploit published | The GdkPixbufLoader function in GIMP ToolKit (GTK+) in GTK 2 (gtk2) before 2.4.13 allows context-dependent attackers to cause a denial of service (crash) via a malformed image file. |
| CVE-2006-6698 | Low | 2006-12-22 | Not applicable | No public exploit | The GConf daemon (gconfd) in GConf 2.14.0 creates temporary files under directories with names based on the username, even when GCONF_GLOBAL_LOCKS is not set, which allows local users to cause a denial of service by creating the directories ahead of time, which prevents other users from using Gnome. |
| CVE-2006-2452 | Low | 2006-06-09 | Not applicable | No public exploit | GNOME GDM 2.8, 2.12, 2.14, and 2.15, when the "face browser" feature is enabled, allows local users to access the "Configure Login Manager" functionality using their own password instead of the root password, which can be leveraged to gain additional privileges. |
| CVE-2006-2789 | Low | 2006-06-02 | Not applicable | No public exploit | Evolution 2.2.x and 2.3.x in GNOME 2.7 and 2.8, when "load images if sender in addressbook" is enabled, allows remote attackers to cause a denial of service (persistent crash) via a crafted "From" header that triggers an assert error in camel-internet-address.c when a null pointer is used. |
| CVE-2006-1057 | Low | 2006-04-25 | Not applicable | No public exploit | Race condition in daemon/slave.c in gdm before 2.14.1 allows local users to gain privileges via a symlink attack when gdm performs chown and chgrp operations on the .ICEauthority file. |
| CVE-2006-1335 | Low | 2006-03-21 | Not applicable | No public exploit | gnome screensaver before 2.14, when running on an X server with AllowDeactivateGrabs and AllowClosedownGrabs enabled, allows attackers with physical access to cause the screensaver to crash and access the session via the Ctl+Alt+Keypad-Multiply keyboard sequence, which removes the grab from gnome. |
| CVE-2005-0023 | Low | 2005-10-05 | Not applicable | Working exploit published | gnome-pty-helper in GNOME libzvt2 and libvte4 allows local users to spoof the logon hostname via a modified DISPLAY environment variable. NOTE: the severity of this issue has been disputed. |
| CVE-2005-1686 | Low | 2005-05-20 | Not applicable | Working exploit published | Format string vulnerability in gedit 2.10.2 may allow attackers to cause a denial of service (application crash) via a bin file with format string specifiers in the filename. NOTE: while this issue is triggered on the command line by the gedit user, it has been reported that web browsers and email clients could be configured to provide a file name as an argument to gedit, so there is a valid attack that crosses security boundaries. |
| CVE-2003-0794 | Low | 2003-11-17 | Not applicable | No public exploit | GDM 2.4.4.x before 2.4.4.4, and 2.4.1.x before 2.4.1.7, does not limit the number or duration of commands and uses a blocking socket connection, which allows attackers to cause a denial of service (resource exhaustion) by sending commands and not reading the results. |
| CVE-2003-0793 | Low | 2003-11-17 | Not applicable | No public exploit | GDM 2.4.4.x before 2.4.4.4, and 2.4.1.x before 2.4.1.7, does not restrict the size of input, which allows attackers to cause a denial of service (memory consumption). |
| CVE-2003-0547 | Low | 2003-08-27 | Not applicable | No public exploit | GDM before 2.4.1.6, when using the "examine session errors" feature, allows local users to read arbitrary files via a symlink attack on the ~/.xsession-errors file. |
| CVE-1999-0990 | Low | 1999-12-05 | Not applicable | No public exploit | Error messages generated by gdm with the VerboseAuth setting allows an attacker to identify valid users on a system. |