CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 29/07/2020 |
| CVE-2014-1422 | MEDIUM5.0 | In Ubuntu's trust-store, if a user revokes location access from an application, the location is still available to the application because the application will honour incorrect, cached permissions. This is because the cache was not ordered by creation time by the Select struct in src/core/trust/impl/sqlite3/store.cpp. | 22/07/2020 |
| CVE-2020-11932 | LOW2.3 | It was discovered that the Subiquity installer for Ubuntu Server logged the LUKS full disk encryption password if one was entered. | 13/05/2020 |
| CVE-2019-11480 | HIGH8.1 | The pc-kernel snap build process hardcoded the --allow-insecure-repositories and --allow-unauthenticated apt options when creating the build chroot environment. This could allow an attacker who is able to perform a MITM attack between the build environment and the Ubuntu archive to install a malicious package within th | 14/04/2020 |
| CVE-2019-15789 | HIGH7.8 | Privilege escalation vulnerability in MicroK8s allows a low privilege user with local access to obtain root access to the host by provisioning a privileged container. Fixed in MicroK8s 1.15.3. | 08/04/2020 |
| CVE-2020-8632 | MEDIUM5.5 | In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easier for attackers to guess passwords. | 05/02/2020 |
| CVE-2020-8631 | MEDIUM5.5 | cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function. | 05/02/2020 |
| CVE-2012-2092 | MEDIUM5.9 | A Security Bypass vulnerability exists in Ubuntu Cobbler before 2,2,2 in the cobbler-ubuntu-import script due to an error when verifying the GPG signature. | 06/12/2019 |
| CVE-2012-6639 | HIGH8.8 | An privilege elevation vulnerability exists in Cloud-init before 0.7.0 when requests to an untrusted system are submitted for EC2 instance data. | 25/11/2019 |
| CVE-2019-11503 | HIGH7.5 | snap-confine as included in snapd before 2.39 did not guard against symlink races when performing the chdir() to the current working directory of the calling user, aka a "cwd restore permission bypass." | 24/04/2019 |
| CVE-2019-11502 | HIGH7.5 | snap-confine in snapd before 2.38 incorrectly set the ownership of a snap application to the uid and gid of the first calling user. Consequently, that user had unintended access to a private /tmp directory. | 24/04/2019 |
| CVE-2019-7304 | CRITICAL9.8 | Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root. This issue affects: Canonical snapd versions prior to 2.37.1. | 23/04/2019 |
| CVE-2019-7303 | HIGH7.5 | A vulnerability in the seccomp filters of Canonical snapd before version 2.37.4 allows a strict mode snap to insert characters into a terminal on a 64-bit host. The seccomp rules were generated to match 64-bit ioctl(2) commands on a 64-bit platform; however, the Linux kernel only uses the lower 32 bits to determine whi | 23/04/2019 |
| CVE-2016-1585 | CRITICAL9.8 | In all versions of AppArmor mount rules are accidentally widened when compiled. | 22/04/2019 |
| CVE-2015-1341 | HIGH7.8 | Any Python module in sys.path can be imported if the command line of the process triggering the coredump is Python and the first argument is -m in Apport before 2.19.2 function _python_module_path. | 22/04/2019 |
| CVE-2015-1320 | CRITICAL9.8 | The SeaMicro provisioning of Ubuntu MAAS logs credentials, including username and password, for the management interface. This issue affects Ubuntu MAAS versions prior to 1.9.2. | 22/04/2019 |
| CVE-2015-1316 | HIGH7.5 | Juju Core's Joyent provider before version 1.25.5 uploads the user's private ssh key. | 22/04/2019 |
| CVE-2014-1428 | MEDIUM5.3 | A vulnerability in generate_filestorage_key of Ubuntu MAAS allows an attacker to brute-force filenames. This issue affects Ubuntu MAAS versions prior to 1.9.2. | 22/04/2019 |