LE
Product
Leap
On CISA KEVExploited in the wildRansomware-linked
1,893
CVEs
19
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 193High 302Medium 5Low 0
Watch
Add Leap to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-18902 | 9.8 | Mar 2 | A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or… Affected: 15.1 |
| CVE-2020-8955 | 9.8 | Feb 12 | irc_mode_channel_update in plugins/irc/irc-mode.c in WeeChat through 2.7 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly… Affected: 15.1 |
| CVE-2019-15606 | 9.8 | Feb 7 | Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons Affected: 15.1 |
| CVE-2019-15605 | 9.8 | Feb 7 | HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed Affected: 15.1 |
| CVE-2020-8432 | 9.8 | Jan 29 | In Das U-Boot through 2020.01, a double free has been found in the cmd/gpt.c do_rename_gpt_parts() function Affected: 15.2 |
| CVE-2019-1353 | 9.8 | Jan 24 | An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6 Affected: 15.1 |
| CVE-2019-17361 | 9.8 | Jan 17 | In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection Affected: 15.1 |
| CVE-2019-19951 | 9.8 | Dec 24 | In GraphicsMagick 1.4 snapshot-20190423 Q8, there is a heap-based buffer overflow in the function ImportRLEPixels of coders/miff.c Affected: 15.1 |
| CVE-2019-19950 | 9.8 | Dec 24 | In GraphicsMagick 1.4 snapshot-20190403 Q8, there is a use-after-free in ThrowException and ThrowLoggedException of magick/error.c Affected: 15.1 |
| CVE-2019-19948 | 9.8 | Dec 24 | In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of coders/sgi.c Affected: 15.1 |
| CVE-2019-17571 | 9.8 | Dec 20 | Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with… Affected: 15.1 |
| CVE-2019-14895 | 9.8 | Nov 29 | A heap-based buffer overflow was discovered in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver Affected: 15.1 |
| CVE-2019-12526 | 9.8 | Nov 26 | An issue was discovered in Squid before 4.9 Affected: 15.0 |
| CVE-2019-18622 | 9.8 | Nov 22 | An issue was discovered in phpMyAdmin before 4.9.2 Affected: 15.0; 15.1 |
| CVE-2019-18805 | 9.8 | Nov 7 | An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel before 5.0.11 Affected: 15.0; 15.1 |
| CVE-2015-8980 | 9.8 | Nov 4 | The plural form formula in ngettext family of calls in php-gettext before 1.0.12 allows remote attackers to execute arbitrary code Affected: 42.1; 42.2 |
| CVE-2019-18425 | 9.8 | Oct 31 | An issue was discovered in Xen through 4.12.x allowing 32-bit PV guest OS users to gain guest OS privileges by installing and using descriptors Affected: 15.0 |
| CVE-2019-17545 | 9.8 | Oct 14 | GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB threshold is exceeded Affected: 15.1 |
| CVE-2019-17455 | 9.8 | Oct 10 | Libntlm through 1.5 relies on a fixed buffer size for tSmbNtlmAuthRequest, tSmbNtlmAuthChallenge, and tSmbNtlmAuthResponse read and write operations, as demonstrated by a… Affected: 15.1 |
| CVE-2019-17042 | 9.8 | Oct 7 | An issue was discovered in Rsyslog v8.1908.0 Affected: 15.0; 15.1 |
| CVE-2019-17041 | 9.8 | Oct 7 | An issue was discovered in Rsyslog v8.1908.0 Affected: 15.0; 15.1 |
| CVE-2019-17133 | 9.8 | Oct 4 | In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c does not reject a long SSID IE, leading to a Buffer Overflow Affected: 15.1 |
| CVE-2019-16746 | 9.8 | Sep 24 | An issue was discovered in net/wireless/nl80211.c in the Linux kernel through 5.2.17 Affected: 15.1 |
| CVE-2019-16239 | 9.8 | Sep 17 | process_http_response in OpenConnect before 8.05 has a Buffer Overflow when a malicious server uses HTTP chunked encoding with crafted chunk sizes Affected: 15.0; 15.1 |
| CVE-2019-5482 | 9.8 | Sep 16 | Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3 Affected: 15.0; 15.1 |
| CVE-2019-5481 | 9.8 | Sep 16 | Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3 Affected: 15.0; 15.1 |
| CVE-2019-9855 | 9.8 | Sep 6 | LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is… Affected: 15.0; 15.1 |
| CVE-2019-14813 | 9.8 | Sep 6 | A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass… Affected: 15.0; 15.1 |
| CVE-2019-9851 | 9.8 | Aug 15 | LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is… Affected: 15.0; 15.1 |
| CVE-2019-9850 | 9.8 | Aug 15 | LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is… Affected: 15.0; 15.1 |
| CVE-2019-14271 | 9.8 | Jul 29 | In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamically loads a library inside a chroot that… Affected: 15.0; 15.1 |
| CVE-2019-11710 | 9.8 | Jul 23 | Mozilla developers and community members reported memory safety bugs present in Firefox 67 Affected: 15.0; 15.1 |
| CVE-2019-11709 | 9.8 | Jul 23 | Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7 Affected: 15.0; 15.1 |
| CVE-2019-13962 | 9.8 | Jul 18 | lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and… Affected: 15.0; 15.1 |
| CVE-2019-9848 | 9.8 | Jul 17 | LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-over, etc Affected: 15.0; 15.1 |
| CVE-2019-12525 | 9.8 | Jul 11 | An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7 Affected: 15.0; 15.1 |
| CVE-2019-12838 | 9.8 | Jul 11 | SchedMD Slurm 17.11.x, 18.08.0 through 18.08.7, and 19.05.0 allows SQL Injection Affected: 15.0; 15.1 |
| CVE-2019-12900 | 9.8 | Jun 19 | BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors Affected: 15.0; 15.1 |
| CVE-2019-10126 | 9.8 | Jun 14 | A flaw was found in the Linux kernel Affected: 15.0; 15.1 |
| CVE-2019-10160 | 9.8 | Jun 7 | A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4… Affected: 15.0; 15.1 |
| CVE-2019-8457 | 9.8 | May 30 | SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables Affected: 42.3 |
| CVE-2019-12450 | 9.8 | May 29 | file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress Affected: 15.0 |
| CVE-2019-5021 | 9.8 | May 8 | Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the `root` user Affected: 15.0; 15.1 |
| CVE-2019-11627 | 9.8 | Apr 30 | gpg-key2ps in signing-party 1.1.x and 2.x before 2.10-1 contains an unsafe shell call enabling shell injection via a User ID Affected: 15.0; 42.3 |
| CVE-2019-11235 | 9.8 | Apr 22 | FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve… Affected: 15.0 |
| CVE-2019-11068 | 9.8 | Apr 10 | libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code Affected: 15.0; 15.1; 42.3 |
| CVE-2019-11005 | 9.8 | Apr 8 | In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a stack-based buffer overflow in the function SVGStartElement of coders/svg.c, which allows remote attackers to cause a denial… Affected: 15.0; 42.3 |
| CVE-2019-0160 | 9.8 | Mar 27 | Buffer overflow in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege and/or denial of service via network access Affected: 15.0 |
| CVE-2019-9898 | 9.8 | Mar 21 | Potential recycling of random numbers used in cryptography exists within PuTTY before 0.71 Affected: 15.0 |
| CVE-2018-20177 | 9.8 | Mar 15 | rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to a Heap-Based Buffer Overflow in the function rdp_in_unistr() and results in memory… Affected: 15.1 |
The 500 most important CVEs for this product (exploited first, then by severity)