{"kind": "product", "path": "vulns/debian-13/dbus", "name": "dbus", "product": "dbus", "ecosystem": "Debian:13", "items": [{"id": "CVE-2023-34969", "noindex": false, "published": "2023-06-08T00:00:00.000Z", "modified": "2026-10-14T23:21:50.473Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.0151, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-34969", "title": "CVE-2023-34969", "description": "D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus, this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6.", "references": ["https://gitlab.freedesktop.org/dbus/dbus/-/issues/457", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZYCDRMD7B4XO4HF6C6YTLH4YUD7TANP/", "https://lists.debian.org/debian-lts-announce/2023/10/msg00033.html"], "fixes": ["1.14.8-1"], "products": [{"name": "dbus", "path": "vulns/debian-13/dbus", "ecosystem": "Debian:13"}]}, {"id": "CVE-2022-42012", "noindex": false, "published": "2022-10-09T00:00:00.000Z", "modified": "2025-06-09T15:04:43.166Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.01768, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-42012", "title": "CVE-2022-42012", "description": "An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by sending a message with attached file descriptors in an unexpected format.", "references": ["https://gitlab.freedesktop.org/dbus/dbus/-/issues/417", "https://www.openwall.com/lists/oss-security/2022/10/06/1", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SQCSLMCK2XGX23R2DKW2MSAICQAK6MT2/"], "fixes": ["1.14.4-1"], "products": [{"name": "dbus", "path": "vulns/debian-13/dbus", "ecosystem": "Debian:13"}]}, {"id": "CVE-2022-42011", "noindex": false, "published": "2022-10-09T00:00:00.000Z", "modified": "2025-06-09T15:05:41.494Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.01768, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-42011", "title": "CVE-2022-42011", "description": "An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message where an array length is inconsistent with the size of the element type.", "references": ["https://gitlab.freedesktop.org/dbus/dbus/-/issues/413", "https://www.openwall.com/lists/oss-security/2022/10/06/1", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SQCSLMCK2XGX23R2DKW2MSAICQAK6MT2/"], "fixes": ["1.14.4-1"], "products": [{"name": "dbus", "path": "vulns/debian-13/dbus", "ecosystem": "Debian:13"}]}, {"id": "CVE-2022-42010", "noindex": false, "published": "2022-10-09T00:00:00.000Z", "modified": "2025-06-09T15:06:45.678Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.01121, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-42010", "title": "CVE-2022-42010", "description": "An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message with certain invalid type signatures.", "references": ["https://gitlab.freedesktop.org/dbus/dbus/-/issues/418", "https://www.openwall.com/lists/oss-security/2022/10/06/1", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SQCSLMCK2XGX23R2DKW2MSAICQAK6MT2/"], "fixes": ["1.14.4-1"], "products": [{"name": "dbus", "path": "vulns/debian-13/dbus", "ecosystem": "Debian:13"}]}, {"id": "CVE-2020-35512", "noindex": false, "published": "2021-02-15T16:08:39.000Z", "modified": "2024-11-19T15:32:44.371Z", "cvss": 7.8, "cvss_vector": "", "severity": "high", "epss": 0.00331, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2020-35512", "title": "CVE-2020-35512", "description": "A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branches <= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors", "references": ["https://bugs.gentoo.org/755392", "https://gitlab.freedesktop.org/dbus/dbus/-/issues/305#note_829128", "https://bugzilla.redhat.com/show_bug.cgi?id=1909101"], "fixes": ["1.12.20-1"], "products": [{"name": "dbus", "path": "vulns/debian-13/dbus", "ecosystem": "Debian:13"}]}, {"id": "CVE-2020-12049", "noindex": false, "published": "2020-06-08T00:00:00.000Z", "modified": "2024-08-04T11:48:57.950Z", "cvss": 5.5, "cvss_vector": "", "severity": "medium", "epss": 0.00569, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2020-12049", "title": "CVE-2020-12049", "description": "An issue was discovered in dbus >= 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-daemon, leaks file descriptors when a message exceeds the per-message file descriptor limit. A local attacker with access to the D-Bus system bus or another system service's private AF_UNIX socket could use this to make the system service reach its file descriptor limit, denying service to subsequent D-Bus clients.", "references": ["https://gitlab.freedesktop.org/dbus/dbus/-/issues/294", "https://gitlab.freedesktop.org/dbus/dbus/-/tags/dbus-1.13.16", "http://www.openwall.com/lists/oss-security/2020/06/04/3"], "fixes": ["1.12.18-1"], "products": [{"name": "dbus", "path": "vulns/debian-13/dbus", "ecosystem": "Debian:13"}]}, {"id": "CVE-2019-12749", "noindex": false, "published": "2019-06-11T16:11:45.000Z", "modified": "2026-02-13T19:57:55.649Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.0055, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2019-12749", "title": "CVE-2019-12749", "description": "dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon), allows cookie spoofing because of symlink mishandling in the reference implementation of DBUS_COOKIE_SHA1 in the libdbus library. (This only affects the DBUS_COOKIE_SHA1 authentication mechanism.) A malicious client with write access to its own home directory could manipulate a ~/.dbus-keyrings symlink to cause a DBusServer with a different uid to read and write in unintended locations. In the worst case, this could result in the DBusServer reusing a cookie that is k", "references": ["https://www.openwall.com/lists/oss-security/2019/06/11/2", "http://www.openwall.com/lists/oss-security/2019/06/11/2", "https://usn.ubuntu.com/4015-1/"], "fixes": ["1.12.16-1"], "products": [{"name": "dbus", "path": "vulns/debian-13/dbus", "ecosystem": "Debian:13"}]}, {"id": "CVE-2015-0245", "noindex": false, "published": "2015-02-13T15:00:00.000Z", "modified": "2024-08-06T04:03:10.538Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00273, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2015-0245", "title": "CVE-2015-0245", "description": "D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds.", "references": ["http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html", "http://lists.opensuse.org/opensuse-updates/2015-02/msg00066.html", "http://www.debian.org/security/2015/dsa-3161"], "fixes": ["1.8.16-1"], "products": [{"name": "dbus", "path": "vulns/debian-13/dbus", "ecosystem": "Debian:13"}]}, {"id": "CVE-2014-7824", "noindex": false, "published": "2014-11-18T15:00:00.000Z", "modified": "2024-08-06T13:03:27.015Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00594, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2014-7824", "title": "CVE-2014-7824", "description": "D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before 1.8.10, and 1.9.x before 1.9.2 allows local users to cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3636.1.", "references": ["http://www.openwall.com/lists/oss-security/2014/11/10/2", "http://secunia.com/advisories/62603", "http://advisories.mageia.org/MGASA-2014-0457.html"], "fixes": ["1.8.10-1"], "products": [{"name": "dbus", "path": "vulns/debian-13/dbus", "ecosystem": "Debian:13"}]}, {"id": "CVE-2014-3636", "noindex": false, "published": "2014-10-25T20:00:00.000Z", "modified": "2024-10-17T18:03:39.167Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00508, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2014-3636", "title": "CVE-2014-3636", "description": "D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 allows local users to (1) cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors or (2) cause a denial of service (disconnect) via multiple messages that combine to have more than the allowed number of file descriptors for a single sendmsg call.", "references": ["http://www.ubuntu.com/usn/USN-2352-1", "http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html", "http://secunia.com/advisories/61378"], "fixes": ["1.8.8-1"], "products": [{"name": "dbus", "path": "vulns/debian-13/dbus", "ecosystem": "Debian:13"}]}, {"id": "CVE-2014-3639", "noindex": false, "published": "2014-09-22T15:00:00.000Z", "modified": "2024-08-06T10:50:18.243Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00403, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2014-3639", "title": "CVE-2014-3639", "description": "The dbus-daemon in D-Bus before 1.6.24 and 1.8.x before 1.8.8 does not properly close old connections, which allows local users to cause a denial of service (incomplete connection consumption and prevention of new connections) via a large number of incomplete connections.", "references": ["http://www.ubuntu.com/usn/USN-2352-1", "http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html", "http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00026.html"], "fixes": ["1.8.8-1"], "products": [{"name": "dbus", "path": "vulns/debian-13/dbus", "ecosystem": "Debian:13"}]}, {"id": "CVE-2014-3638", "noindex": false, "published": "2014-09-22T15:00:00.000Z", "modified": "2024-08-06T10:50:17.924Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00391, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2014-3638", "title": "CVE-2014-3638", "description": "The bus_connections_check_reply function in config-parser.c in D-Bus before 1.6.24 and 1.8.x before 1.8.8 allows local users to cause a denial of service (CPU consumption) via a large number of method calls.", "references": ["http://www.ubuntu.com/usn/USN-2352-1", "http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html", "http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00026.html"], "fixes": ["1.8.8-1"], "products": [{"name": "dbus", "path": "vulns/debian-13/dbus", "ecosystem": "Debian:13"}]}, {"id": "CVE-2014-3637", "noindex": false, "published": "2014-09-22T15:00:00.000Z", "modified": "2024-08-06T10:50:18.287Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00447, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2014-3637", "title": "CVE-2014-3637", "description": "D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 does not properly close connections for processes that have terminated, which allows local users to cause a denial of service via a D-bus message containing a D-Bus connection file descriptor.", "references": ["http://www.ubuntu.com/usn/USN-2352-1", "https://bugs.freedesktop.org/show_bug.cgi?id=80559", "http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html"], "fixes": ["1.8.8-1"], "products": [{"name": "dbus", "path": "vulns/debian-13/dbus", "ecosystem": "Debian:13"}]}, {"id": "CVE-2014-3635", "noindex": false, "published": "2014-09-22T15:00:00.000Z", "modified": "2024-08-06T10:50:18.235Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00486, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2014-3635", "title": "CVE-2014-3635", "description": "Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running on a 64-bit system and the max_message_unix_fds limit is set to an odd number, allows local users to cause a denial of service (dbus-daemon crash) or possibly execute arbitrary code by sending one more file descriptor than the limit, which triggers a heap-based buffer overflow or an assertion failure.", "references": ["http://www.ubuntu.com/usn/USN-2352-1", "http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html", "https://bugs.freedesktop.org/show_bug.cgi?id=83622"], "fixes": ["1.8.8-1"], "products": [{"name": "dbus", "path": "vulns/debian-13/dbus", "ecosystem": "Debian:13"}]}, {"id": "CVE-2014-3533", "noindex": false, "published": "2014-07-19T19:00:00.000Z", "modified": "2024-08-06T10:50:16.803Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00417, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2014-3533", "title": "CVE-2014-3533", "description": "dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6 allows local users to cause a denial of service (disconnect) via a certain sequence of crafted messages that cause the dbus-daemon to forward a message containing an invalid file descriptor.", "references": ["http://secunia.com/advisories/59798", "http://secunia.com/advisories/59611", "http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html"], "fixes": ["1.8.6-1"], "products": [{"name": "dbus", "path": "vulns/debian-13/dbus", "ecosystem": "Debian:13"}]}, {"id": "CVE-2014-3532", "noindex": false, "published": "2014-07-19T19:00:00.000Z", "modified": "2024-08-06T10:50:16.897Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00446, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2014-3532", "title": "CVE-2014-3532", "description": "dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6, when running on Linux 2.6.37-rc4 or later, allows local users to cause a denial of service (system-bus disconnect of other services or applications) by sending a message containing a file descriptor, then exceeding the maximum recursion depth before the initial message is forwarded.", "references": ["http://secunia.com/advisories/59798", "http://secunia.com/advisories/59611", "http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html"], "fixes": ["1.8.6-1"], "products": [{"name": "dbus", "path": "vulns/debian-13/dbus", "ecosystem": "Debian:13"}]}, {"id": "CVE-2014-3477", "noindex": false, "published": "2014-07-01T17:00:00.000Z", "modified": "2025-01-16T20:11:35.974Z", "cvss": 4, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00444, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2014-3477", "title": "CVE-2014-3477", "description": "The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service, which allows local users to cause a denial of service (initialization failure and exit) or possibly conduct a side-channel attack via a D-Bus message to an inactive service.", "references": ["http://secunia.com/advisories/59798", "http://secunia.com/advisories/59611", "http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html"], "fixes": ["1.8.4-1"], "products": [{"name": "dbus", "path": "vulns/debian-13/dbus", "ecosystem": "Debian:13"}]}, {"id": "CVE-2013-2168", "noindex": false, "published": "2013-07-03T18:00:00.000Z", "modified": "2024-08-06T15:27:41.099Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00383, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2013-2168", "title": "CVE-2013-2168", "description": "The _dbus_printf_string_upper_bound function in dbus/dbus-sysdeps-unix.c in D-Bus (aka DBus) 1.4.x before 1.4.26, 1.6.x before 1.6.12, and 1.7.x before 1.7.4 allows local users to cause a denial of service (service crash) via a crafted message.", "references": ["http://www.debian.org/security/2013/dsa-2707", "http://lists.fedoraproject.org/pipermail/package-announce/2013-June/110114.html", "http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html"], "fixes": ["1.6.12-1"], "products": [{"name": "dbus", "path": "vulns/debian-13/dbus", "ecosystem": "Debian:13"}]}, {"id": "CVE-2012-3524", "noindex": false, "published": "2012-09-18T17:00:00.000Z", "modified": "2024-08-06T20:05:12.760Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.04477, "kev": false, "exploits": ["exploitdb"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2012-3524", "title": "CVE-2012-3524", "description": "libdbus 1.5.x and earlier, when used in setuid or other privileged programs in X.org and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable.  NOTE: libdbus maintainers state that this is a vulnerability in the applications that do not cleanse environment variables, not in libdbus itself: \"we do not support use of libdbus in setuid binaries that do not sanitize their environment before their first call into libdbus.\"", "references": ["http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00009.html", "http://www.openwall.com/lists/oss-security/2012/09/12/6", "http://www.openwall.com/lists/oss-security/2012/07/26/1"], "fixes": ["1.6.8-1"], "products": [{"name": "dbus", "path": "vulns/debian-13/dbus", "ecosystem": "Debian:13"}]}, {"id": "CVE-2011-2533", "noindex": false, "published": "2011-06-22T23:00:00.000Z", "modified": "2024-08-06T23:08:22.434Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00286, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2011-2533", "title": "CVE-2011-2533", "description": "The configure script in D-Bus (aka DBus) 1.2.x before 1.2.28 allows local users to overwrite arbitrary files via a symlink attack on an unspecified file in /tmp/.", "references": ["http://cgit.freedesktop.org/dbus/dbus/tree/NEWS?h=dbus-1.2", "https://exchange.xforce.ibmcloud.com/vulnerabilities/68173", "http://www.securitytracker.com/id?1025720"], "fixes": ["1.3.2~git20100715.821f99c-1"], "products": [{"name": "dbus", "path": "vulns/debian-13/dbus", "ecosystem": "Debian:13"}]}], "total": 28, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "dbus", "path": "vulns/debian-13/dbus", "ecosystem": "Debian:13"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-10-14T23:21:50.473Z", "early_advisories": [], "license": "Puedes utilizar libremente la selección de PatchFirst y nuestras aportaciones (prioridades, alertas tempranas, textos, resúmenes y agregados) para tus propios fines, incluido el uso interno de tu empresa. La reventa, la distribución comercial y la creación masiva de réplicas de esta selección o de estas aportaciones requieren un acuerdo escrito con el operador. Siempre que uses o publiques la selección o nuestras aportaciones, cita a PatchFirst (https://patchfirst.dev/vulns/) con este enlace a la página del flujo de tu región. Los registros originales de fuentes abiertas siguen sujetos a sus respectivas licencias y condiciones. Estas condiciones no limitan tus derechos sobre los datos originales, que puedes obtener directamente de esas fuentes.", "terms_url": "https://patchfirst.dev/es/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst selecciona, normaliza y combina los registros; se pueden añadir resúmenes y traducciones. Las noticias incluyen un enlace a la fuente original en cada entrada.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Las licencias de las bases originales varían; consulta el catálogo de fuentes."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Puntuaciones públicas gratuitas; se solicita atribución (FIRST EPSS, puntuaciones generadas por Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}