LE
Product
Leap
On CISA KEVExploited in the wildRansomware-linked
1,893
CVEs
19
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 193High 302Medium 5Low 0
Watch
Add Leap to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-4539 | 9.8 | May 22 | The xml_parse_into_struct function in ext/xml/xml.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (buffer… Affected: 42.1 |
| CVE-2016-4538 | 9.8 | May 22 | The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 modifies certain data structures without considering whether they are… Affected: 42.1 |
| CVE-2016-4537 | 9.8 | May 22 | The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 accepts a negative integer for the scale argument, which allows remote… Affected: 42.1 |
| CVE-2016-4346 | 9.8 | May 22 | Integer overflow in the str_pad function in ext/standard/string.c in PHP before 7.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other… Affected: 42.1 |
| CVE-2015-4116 | 9.8 | May 16 | Use-after-free vulnerability in the spl_ptr_heap_insert function in ext/spl/spl_heap.c in PHP before 5.5.27 and 5.6.x before 5.6.11 allows remote attackers to execute arbitrary… Affected: 42.1 |
| CVE-2015-8863 | 9.8 | May 6 | Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a… Affected: 42.1 |
| CVE-2016-1659 | 9.8 | Apr 18 | Multiple unspecified vulnerabilities in Google Chrome before 50.0.2661.75 allow attackers to cause a denial of service or possibly have other impact via unknown vectors Affected: 42.1 |
| CVE-2016-4007 | 9.8 | Apr 13 | Multiple unspecified vulnerabilities in the obs-service-extract_file package before 0.3-5.1 in openSUSE Leap 42.1 and before 0.3-3.1 in openSUSE 13.2 allow attackers to execute… Affected: 42.1 |
| CVE-2016-2324 | 9.8 | Apr 8 | Integer overflow in Git before 2.7.4 allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, which triggers a heap-based buffer… Affected: 42.1 |
| CVE-2016-2315 | 9.8 | Apr 8 | revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees,… Affected: 42.1 |
| CVE-2016-2851 | 9.8 | Apr 7 | Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corruption and application crash) or execute… Affected: 42.1 |
| CVE-2015-8805 | 9.8 | Feb 23 | The ecc_256_modq function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST… Affected: 42.1 |
| CVE-2015-8804 | 9.8 | Feb 23 | x86_64/ecc-384-modp.asm in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-384 NIST elliptic curve, which… Affected: 42.1 |
| CVE-2015-8803 | 9.8 | Feb 23 | The ecc_256_modp function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST… Affected: 42.1 |
| CVE-2016-1629 | 9.8 | Feb 21 | Google Chrome before 48.0.2564.116 allows remote attackers to bypass the Blink Same Origin Policy and a sandbox protection mechanism via unspecified vectors Affected: 42.1 |
| CVE-2016-0746 | 9.8 | Feb 15 | Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (worker process crash) or… Affected: 42.1 |
| CVE-2016-1946 | 9.8 | Jan 31 | The MoofParser::Metadata function in binding/MoofParser.cpp in libstagefright in Mozilla Firefox before 44.0 does not limit the size of read operations, which might allow remote… Affected: 42.1 |
| CVE-2016-1944 | 9.8 | Jan 31 | The Buffer11::NativeBuffer11::map function in ANGLE, as used in Mozilla Firefox before 44.0, might allow remote attackers to cause a denial of service (memory corruption) or… Affected: 42.1 |
| CVE-2016-1930 | 9.8 | Jan 31 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 44.0 and Firefox ESR 38.x before 38.6 allow remote attackers to cause a denial of service… Affected: 42.1 |
| CVE-2020-16011 | 9.6 | Nov 3 | Heap buffer overflow in UI in Google Chrome on Windows prior to 86.0.4240.183 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox… Affected: 15.1; 15.2 |
| CVE-2020-6573 | 9.6 | Sep 21 | Use after free in video in Google Chrome on Android prior to 85.0.4183.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox… Affected: 15.1; 15.2 |
| CVE-2020-15963 | 9.6 | Sep 21 | Insufficient policy enforcement in extensions in Google Chrome prior to 85.0.4183.121 allowed an attacker who convinced a user to install a malicious extension to potentially… Affected: 15.1; 15.2 |
| CVE-2020-15961 | 9.6 | Sep 21 | Insufficient policy validation in extensions in Google Chrome prior to 85.0.4183.121 allowed an attacker who convinced a user to install a malicious extension to potentially… Affected: 15.1; 15.2 |
| CVE-2020-6522 | 9.6 | Jul 22 | Inappropriate implementation in external protocol handlers in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially perform a sandbox escape via a crafted… Affected: 15.1; 15.2 |
| CVE-2020-6493 | 9.6 | Jun 3 | Use after free in WebAuthentication in Google Chrome prior to 83.0.4103.97 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox… Affected: 15.1 |
| CVE-2020-6471 | 9.6 | May 21 | Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious extension to potentially… Affected: 15.1 |
| CVE-2020-6469 | 9.6 | May 21 | Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious extension to potentially… Affected: 15.1 |
| CVE-2020-6466 | 9.6 | May 21 | Use after free in media in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a… Affected: 15.1 |
| CVE-2020-6465 | 9.6 | May 21 | Use after free in reader mode in Google Chrome on Android prior to 83.0.4103.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox… Affected: 15.1 |
| CVE-2015-8866 | 9.6 | May 22 | ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads,… Affected: 42.1 |
| CVE-2020-15229 | 9.3 | Oct 14 | Singularity (an open source container platform) from version 3.1.1 through 3.6.3 has a vulnerability Affected: 15.1; 15.2 |
| CVE-2020-13112 | 9.1 | May 21 | An issue was discovered in libexif before 0.6.22 Affected: 15.1 |
| CVE-2020-7043 | 9.1 | Feb 27 | An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL before 1.0.2 Affected: 15.1 |
| CVE-2020-7060 | 9.1 | Feb 10 | When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data… Affected: 15.1 |
| CVE-2020-7059 | 9.1 | Feb 10 | When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will… Affected: 15.1 |
| CVE-2019-20367 | 9.1 | Jan 8 | nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab) Affected: 15.1 |
| CVE-2019-19953 | 9.1 | Dec 24 | In GraphicsMagick 1.4 snapshot-20191208 Q8, there is a heap-based buffer over-read in the function EncodeImage of coders/pict.c Affected: 15.1 |
| CVE-2019-19949 | 9.1 | Dec 24 | In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of coders/png.c, related to Magick_png_write_raw_profile and LocaleNCompare Affected: 15.1 |
| CVE-2019-12523 | 9.1 | Nov 26 | An issue was discovered in Squid before 4.9 Affected: 15.0 |
| CVE-2019-11040 | 9.1 | Jun 19 | When PHP EXIF extension is parsing EXIF information from an image, e.g Affected: 15.0; 15.1 |
| CVE-2019-11039 | 9.1 | Jun 19 | Function iconv_mime_decode_headers() in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 may perform out-of-buffer read due to integer overflow when… Affected: 15.0; 15.1 |
| CVE-2019-11036 | 9.1 | May 3 | When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused to read past allocated buffer in… Affected: 15.0; 15.1; 42.3 |
| CVE-2019-11035 | 9.1 | Apr 18 | When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in… Affected: 15.0; 15.1; 42.3 |
| CVE-2019-11034 | 9.1 | Apr 18 | When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in… Affected: 15.0; 15.1; 42.3 |
| CVE-2019-11006 | 9.1 | Apr 8 | In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer over-read in the function ReadMIFFImage of coders/miff.c, which allows attackers to cause a denial of… Affected: 15.0; 42.3 |
| CVE-2019-3860 | 9.1 | Mar 25 | An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed Affected: 15.0; 42.3 |
| CVE-2019-3861 | 9.1 | Mar 25 | An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed Affected: 15.0; 42.3 |
| CVE-2019-9948 | 9.1 | Mar 23 | urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as… Affected: 15.0; 42.3 |
| CVE-2019-3858 | 9.1 | Mar 21 | An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server Affected: 15.0; 42.3 |
| CVE-2019-3862 | 9.1 | Mar 20 | An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed Affected: 42.3 |
The 500 most important CVEs for this product (exploited first, then by severity)