4180 matches found
CVE-2025-20334
A vulnerability in the HTTP API subsystem of Cisco IOS XE Software could allow a remote attacker to inject commands that will execute with root privileges into the underlying operating system. This vulnerability is due to insufficient input validation. An attacker with administrative privileges...
CVE-2025-20334
A vulnerability in the HTTP API subsystem of Cisco IOS XE Software could allow a remote attacker to inject commands that will execute with root privileges into the underlying operating system. This vulnerability is due to insufficient input validation. An attacker with administrative privileges...
CVE-2025-20334
Cisco IOS XE Software HTTP API Command Injection vulnerability (CVE-2025-20334) in the HTTP API subsystem allows an attacker to execute commands with root privileges due to insufficient input validation. A remote attacker with administrative privileges can exploit via an API call with crafted inp...
Cisco IOS XE Software HTTP API Command Injection Vulnerability
A vulnerability in the HTTP API subsystem of Cisco IOS XE Software could allow a remote attacker to inject commands that will execute with root privileges into the underlying operating system. This vulnerability is due to insufficient input validation. An attacker with administrative privileges...
UBUNTU-CVE-2025-23274
NVIDIA nvJPEG contains a vulnerability in jpeg encoding where a user may cause an out-of-bounds read by providing a maliciously crafted input image with dimensions that cause integer overflows in array index calculations. A successful exploit of this vulnerability may lead to denial of service...
CVE-2025-23274
NVIDIA nvJPEG contains a vulnerability in jpeg encoding where a user may cause an out-of-bounds read by providing a maliciously crafted input image with dimensions that cause integer overflows in array index calculations. A successful exploit of this vulnerability may lead to denial of service...
PT-2025-39253
Name of the Vulnerable Software and Affected Versions NVIDIA nvJPEG affected versions not specified Description The software contains a flaw in JPEG encoding that could allow an attacker to trigger an out-of-bounds read by supplying a specially designed image. The image dimensions are crafted to...
Use After Free
Overview Affected versions of this package are vulnerable to Use After Free via the parsejobsini function. An attacker can cause memory corruption or potentially execute arbitrary code by providing specially crafted input to this process. Remediation There is no fixed version for axboe/fio...
imagemagick: ImageMagick (WriteBMPImage): 32-bit integer overflow when writing BMP scanline stride → heap buffer overflow
A flaw was found in ImageMagick. In 32-bit builds, the Bitmap encoder miscalculates the stride value when processing images with very large with. Mathematically, the stride value is calculated as width multiplied by 3 but the theoretical limit of such value is 2^32 for 32-bit integers. So, if thi...
Fedora 41 : perl-Cpanel-JSON-XS (2025-89495f6403)
The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-89495f6403 advisory. This update fixes an issue where a specially-crafted JSON input could cause an integer overflow leading to a crash in the program parsing the JSON...
CVE-2025-23328
NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause an out-of-bounds write through a specially crafted input. A successful exploit of this vulnerability might lead to denial of service...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the comliferayportalsearchwebportletSearchPortletuserId parameter. An attacker can execute arbitrary web scripts or inject malicious HTML by supplying crafted input. Details Cross-site scripting or XSS is a...
CVE-2025-43801
Unchecked input for loop condition vulnerability in XML-RPC in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers...
Buffer Overflow
Overview Affected versions of this package are vulnerable to Buffer Overflow via improper handling of memory operations. An attacker can execute arbitrary code by triggering memory corruption through crafted input. Remediation Upgrade Firefox to version 143.0 or higher. References - Mozilla...
Buffer Overflow
Overview Affected versions of this package are vulnerable to Buffer Overflow via improper handling of memory operations. An attacker can execute arbitrary code by triggering memory corruption through crafted input. Remediation Upgrade Firefox-ESR to version 140.3 or higher. References - Mozilla...
Buffer Overflow
Overview Affected versions of this package are vulnerable to Buffer Overflow via improper handling of memory operations. An attacker can execute arbitrary code by triggering memory corruption through crafted input. Remediation Upgrade thunderbird-ESR to version 140.3 or higher. References - Mozil...
Buffer Overflow
Overview Affected versions of this package are vulnerable to Buffer Overflow via improper handling of memory operations. An attacker can execute arbitrary code by triggering memory corruption through crafted input. Remediation Upgrade thunderbird to version 143.0 or higher. References - Mozilla...
CVE-2022-50313
Summary: CVE-2022-50313 affects the Linux kernel (EROF S subsystem). The root cause is that the i_size field is signed; crafted negative i_size can be interpreted as a fast symlink, triggering an order = MAX_ORDER warning. The fix changes the handling to fall back to the generic path for such unu...