LE
Product
Leap
On CISA KEVExploited in the wildRansomware-linked
1,893
CVEs
19
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 193High 302Medium 5Low 0
Watch
Add Leap to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-2792 | 8.8 | Mar 13 | The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to… Affected: 42.1 |
| CVE-2016-2791 | 8.8 | Mar 13 | The graphite2::GlyphCache::glyph function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a… Affected: 42.1 |
| CVE-2016-2790 | 8.8 | Mar 13 | The graphite2::TtfUtil::GetTableInfo function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, does not initialize memory for… Affected: 42.1 |
| CVE-2016-1977 | 8.8 | Mar 13 | The Machine::Code::decoder::analysis::set_ref function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers… Affected: 42.1 |
| CVE-2016-1974 | 8.8 | Mar 13 | The nsScannerString::AppendUnicodeTo function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not verify that memory allocation succeeds, which allows remote… Affected: 42.1 |
| CVE-2016-1964 | 8.8 | Mar 13 | Use-after-free vulnerability in the AtomicBaseIncDec function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or… Affected: 42.1 |
| CVE-2016-1961 | 8.8 | Mar 13 | Use-after-free vulnerability in the nsHTMLDocument::SetBody function in dom/html/nsHTMLDocument.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote… Affected: 42.1 |
| CVE-2016-1960 | 8.8 | Mar 13 | Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute… Affected: 42.1 |
| CVE-2016-1954 | 8.8 | Mar 13 | The nsCSPContext::SendReports function in dom/security/nsCSPContext.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not prevent use of a non-HTTP… Affected: 42.1 |
| CVE-2016-1953 | 8.8 | Mar 13 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 45.0 allow remote attackers to cause a denial of service (memory corruption and application… Affected: 42.1 |
| CVE-2016-1952 | 8.8 | Mar 13 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allow remote attackers to cause a denial of service… Affected: 42.1 |
| CVE-2016-2329 | 8.8 | Feb 12 | libavcodec/tiff.c in FFmpeg before 2.8.6 does not properly validate RowsPerStrip values and YCbCr chrominance subsampling factors, which allows remote attackers to cause a denial… Affected: 42.1 |
| CVE-2016-1945 | 8.8 | Jan 31 | The nsZipArchive function in Mozilla Firefox before 44.0 might allow remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging… Affected: 42.1 |
| CVE-2016-1935 | 8.8 | Jan 31 | Buffer overflow in the BufferSubData function in Mozilla Firefox before 44.0 and Firefox ESR 38.x before 38.6 allows remote attackers to execute arbitrary code via crafted WebGL… Affected: 42.1 |
| CVE-2020-27153 | 8.6 | Oct 15 | In BlueZ before 5.55, a double free was found in the gatttool disconnect_cb() routine from shared/att.c Affected: 15.1; 15.2 |
| CVE-2020-10878 | 8.6 | Jun 5 | Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation Affected: 15.1 |
| CVE-2020-2959 | 8.6 | Apr 15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core) Affected: 15.1 |
| CVE-2019-10185 | 8.6 | Jul 31 | It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file Affected: 15.0 |
| CVE-2019-10906 | 8.6 | Apr 7 | In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape Affected: 15.0; 42.3 |
| CVE-2019-5736 | 8.6 | Feb 11 | runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by… Affected: 15.0; 15.1; 42.3 |
| CVE-2016-1286 | 8.6 | Mar 9 | named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted signature… Affected: 42.1 |
| CVE-2016-3100 | 8.4 | Jul 13 | kinit in KDE Frameworks before 5.23.0 uses weak permissions (644) for /tmp/xauth-xxx-_y, which allows local users to obtain X11 cookies of other users and consequently capture… Affected: 42.1 |
| CVE-2016-1572 | 8.4 | Jan 22 | mount.ecryptfs_private.c in eCryptfs-utils does not validate mount destination filesystem types, which allows local users to gain privileges by mounting over a nonstandard… Affected: 42.1 |
| CVE-2020-6575 | 8.3 | Sep 21 | Race in Mojo in Google Chrome prior to 85.0.4183.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML… Affected: 15.1; 15.2 |
| CVE-2020-14583 | 8.3 | Jul 15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries) Affected: 15.1; 15.2 |
| CVE-2020-13398 | 8.3 | May 22 | An issue was discovered in FreeRDP before 2.1.1 Affected: 15.1 |
| CVE-2020-2805 | 8.3 | Apr 15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries) Affected: 15.1; 15.2 |
| CVE-2020-2803 | 8.3 | Apr 15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries) Affected: 15.1; 15.2 |
| CVE-2019-9811 | 8.3 | Jul 23 | As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that used the compromised… Affected: 15.0; 15.1 |
| CVE-2020-10713 | 8.2 | Jul 30 | A flaw was found in grub2, prior to version 2.06 Affected: 15.1; 15.2 |
| CVE-2020-14628 | 8.2 | Jul 15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core) Affected: 15.1; 15.2 |
| CVE-2020-10543 | 8.2 | Jun 5 | Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow Affected: 15.1 |
| CVE-2020-13379 | 8.2 | Jun 3 | The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue Affected: 15.2 |
| CVE-2020-13113 | 8.2 | May 21 | An issue was discovered in libexif before 0.6.22 Affected: 15.1 |
| CVE-2020-2908 | 8.2 | Apr 15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core) Affected: 15.1 |
| CVE-2020-2905 | 8.2 | Apr 15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core) Affected: 15.1 |
| CVE-2020-2758 | 8.2 | Apr 15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core) Affected: 15.1 |
| CVE-2020-2742 | 8.2 | Apr 15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core) Affected: 15.1 |
| CVE-2019-2867 | 8.2 | Jul 23 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core) Affected: 15.0; 15.1 |
| CVE-2019-2866 | 8.2 | Jul 23 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core) Affected: 15.0; 15.1 |
| CVE-2019-6486 | 8.2 | Jan 24 | Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or possibly conduct… Affected: 15.0 |
| CVE-2020-26117 | 8.1 | Sep 27 | In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions Affected: 15.2 |
| CVE-2020-25039 | 8.1 | Sep 16 | Sylabs Singularity 3.2.0 through 3.6.2 has Insecure Permissions on temporary directories used in fakeroot or user namespace container execution Affected: 15.1; 15.2 |
| CVE-2020-12693 | 8.1 | May 21 | Slurm 19.05.x before 19.05.7 and 20.02.x before 20.02.3, in the rare case where Message Aggregation is enabled, allows Authentication Bypass via an Alternate Path or Channel Affected: 15.1; 15.2 |
| CVE-2020-7040 | 8.1 | Jan 21 | storeBackup.pl in storeBackup through 3.5 relies on the /tmp/storeBackup.lock pathname, which allows symlink attacks that possibly lead to privilege escalation Affected: 15.1 |
| CVE-2020-2604 | 8.1 | Jan 15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization) Affected: 15.1 |
| CVE-2020-6614 | 8.1 | Jan 8 | GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in bfr_read in decode.c Affected: 15.1 |
| CVE-2020-6613 | 8.1 | Jan 8 | GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in bit_search_sentinel in bits.c Affected: 15.1 |
| CVE-2020-6612 | 8.1 | Jan 8 | GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in copy_compressed_bytes in decode_r2007.c Affected: 15.1 |
| CVE-2019-16776 | 8.1 | Dec 13 | Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write Affected: 15.1 |
The 500 most important CVEs for this product (exploited first, then by severity)