CVE-2024-23622

CVE-2024-23622 describes a stack-based buffer overflow in IBM Merge Healthcare eFilm Workstation license server, specifically involving the CopySLS_Request3 path. The vulnerability allows remote, unauthenticated attackers to trigger code execution with SYSTEM privileges, over the network. Documen...

CVE-2007-1192

CVE-2007-1192 affects HyperBook Guestbook 1.30. The issue is improper access control: sensitive data is stored under the web root, enabling a remote attacker to directly download the admin password hash from data/gbconfiguration.dat. This constraint is evidenced across multiple sources in the con...

CVE-2017-8516

The CVE-2017-8516 entry applies to Microsoft SQL Server Analysis Services across SQL Server 2012, 2014, and 2016, describing an information disclosure vulnerability caused by improper enforcement of permissions. The vulnerability is characterized by a CVSS v3.1 base score of 7.5 (HIGH) and CVSS v...

CVE-2023-38408

The CVE-2023-38408 issue affects OpenSSH’s ssh-agent PKCS#11 support, where an insufficiently trustworthy search path (notably code loaded from /usr/lib) enables remote code execution when an agent is forwarded to an attacker-controlled system; this stems from an incomplete fix for CVE-2016-10009...

CVE-2020-15778

The CVE-2020-15778 entry covers a command-injection flaw in scp within OpenSSH up to version 8.3p1. The vulnerability resides in scp.c toremote, enabling arbitrary command execution when a destination argument contains backtick characters; the vendor notes they intentionally forgo validating anom...

CVE-2017-7679

CVE-2017-7679 affects Apache HTTP Server (httpd) mod_mime. A buffer over-read allows reading one byte past the end of a buffer when sending a malicious Content-Type header, potentially enabling a crash or memory access issues. Affected products include httpd 2.2.x before 2.2.33 and 2.4.x before 2...

CVE-2022-31813

CVE-2022-31813 affects Apache HTTP Server 2.4.53 and older; due to hop-by-hop handling, X-Forwarded-* headers may be dropped to the origin server, which can enable bypass of IP-based authentication. All connected advisories indicate the fix is in Apache HTTP Server 2.4.54 and related updates in d...

CVE-2021-41617

CVE-2021-41617 affects OpenSSH sshd (versions 6.2–8.x prior to 8.8) where certain non-default configurations allow local privilege escalation because supplemental groups are not initialized as expected when AuthorizedKeysCommand/AuthorizedPrincipalsCommand run under a different user. This can cau...

CVE-2006-0987

CVE-2006-0987 affects ISC BIND configured as a caching DNS server, where the default setup before 9.4.1-P1 allows recursive queries and leaks delegation information to arbitrary IPs, enabling remote attackers to trigger traffic amplification and a denial of service via spoofed DNS queries. The co...

CVE-2020-14145

The CVE-2020-14145 entry concerns the OpenSSH client, with versions 5.7–8.4 (and notes that 8.5/8.6 may also be affected) exhibiting an observable discrepancy in the algorithm negotiation that leads to information leakage. The impact is a potential man-in-the-middle attack during initial connecti...

CVE-2014-9295

CVE-2014-9295 describes multiple stack-based buffer overflows in ntpd (before 4.2.8) that enable a remote, unauthenticated attacker to cause arbitrary code execution by sending specially crafted packets. The issues affect ntpd components crypto_recv() when Autokey is used, ctl_putdata(), and conf...

CVE-2013-6629

The CVE-2013-6629 issue affects libjpeg 6b and libjpeg-turbo up to 1.3.0, used by Chrome prior to 31.0.1650.48, Ghostscript, and other products. The vulnerability arises in get_sos() in jdmarker.c, which does not properly validate certain duplications of component data after SOS JPEG markers, all...

CVE-2011-4108

The CVE-2011-4108 issue concerns the DTLS implementation in OpenSSL. Affected versions are OpenSSL before 0.9.8s and OpenSSL 1.x before 1.0.0f, where a MAC check is performed only if certain padding is valid, enabling a padding oracle that can aid plaintext recovery. This is explicitly described ...

CVE-2014-9294

CVE-2014-9294 concerns ntp-keygen generating weak MD5 keys due to a non-cryptographic RNG seed in ntp-keygen before 4.2.7p230. The IBM AIX advisory confirms this weak RNG seed and lists fixes for both NTPv3 and NTPv4, with interim and packaged updates available (e.g., specific AIX fixes and downl...

CVE-2013-0169

The CVE-2013-0169 vulnerability is a timing-side‑channel flaw in CBC padding handling (Lucky Thirteen) that affects TLS/DTLS implementations such as OpenSSL, OpenJDK, and PolarSSL. Root cause: incorrect/insufficient consideration of timing during the MAC/padding check when processing malformed CB...

CVE-2011-4109

CVE-2011-4109 affects OpenSSL 0.9.8 prior to 0.9.8s. The double-free occurs when X509_V_FLAG_POLICY_CHECK is enabled, allowing remote attackers to trigger a policy-check failure with an unspecified impact. Mitigation: upgrade to OpenSSL 0.9.8s or newer (as reflected in multiple advisories; apply ...

CVE-2014-3470

CVE-2014-3470 is an OpenSSL vulnerability where the ssl3_send_client_key_exchange in s3_clnt.c can trigger a NULL certificate value when using anonymous ECDH cipher suites, leading to a denial-of-service via NULL pointer dereference and client crash. Affected OpenSSL versions are before 0.9.8za, ...

CVE-2011-4619

OpenSSL CVE-2011-4619 concerns the Server Gated Cryptography (SGC) handshake restart handling. The vulnerability exists in OpenSSL prior to 0.9.8s and in 1.x prior to 1.0.0f, where improper handling of handshake restarts can allow remote attackers to cause a denial-of-service (CPU consumption). C...

CVE-2014-0429

CVE-2014-0429 is an unspecified vulnerability in the Java 2D component affecting Oracle Java SE 5.0u61, 6u71, 7u51, 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51. Impact is described as complete confidentiality, integrity, and availability violations via unknown vectors in the 2D comp...

CVE-2014-4263

CVE-2014-4263 is an unspecified security vulnerability with partial confidentiality and partial integrity impact (no availability impact) affecting IBM Java SDK/JRE components used in IBM SAN Volume Controller and Storwize family, among others. IBM’s remediation guidance consistently recommends u...

CVE-2023-32302

SilverStripe Framework vulnerability CVE-2023-32302: When a new Member record is created, an empty password can be stored, and while the default member authenticator rejects empty passwords, custom authentication methods may allow login with an empty password if the attacker knows the user’s emai...

CVE-2011-4449

CVE-2011-4449 affects WikkaWiki 1.3.1 and 1.3.2. When INTRANET_MODE is enabled, the actions/files/files.php upload handling permits uploading files with extensions typically not listed in Apache’s TypesConfig, enabling remote attackers to place multi-extension files (e.g., .mm or .vpp) and execut...

CVE-2014-0449

CVE-2014-0449 is an unspecified vulnerability in the Deployment component affecting Oracle Java SE 6u71, 7u51, 8, and Java SE Embedded 7u51. The issue could allow a remote attacker to affect confidentiality via unknown vectors. The IBM/Red Hat ecosystem references this CVE among several Java-rela...

CVE-2014-1492

The connected document confirms CVE-2014-1492 relates to Mozilla NSS: the cert_TestHostName function in NSS 3.x (lib/certdb/certdb.c) may accept a wildcard embedded in an internationalized domain name’s U-label, enabling MITM spoofing of SSL servers. The description similarly states the vulnerabi...

CVE-2014-0448

CVE-2014-0448 affects Oracle Java SE 7u51 and Java 8 Deployment. The vulnerability is described as unspecified with attacks possible via Deployment vectors, impacting confidentiality, integrity, and availability. Connected sources (IBM bulletin entries) corroborate the CVE and reference remediati...

CVE-2014-1491

CVE-2014-1491 describes an issue in the Mozilla NSS library where public DH values were not properly restricted, enabling remote attackers to bypass cryptographic protections in ticket handling when NSS was used (e.g., in Firefox/Thunderbird/SeaMonkey). The vulnerability affects NSS

CVE-2012-0050

OpenSSL versions affected: 0.9.8s and 1.0.0f. DTLS support flaw leads to remote denial of service via an out-of-bounds read, noted as stemming from an incorrect fix for CVE-2011-4108. Connected ALT Linux advisories show fixes for CVE-2012-0050 by upgrading OpenSSL to 1.0.0h (e.g., openssl1.0h-alt...

CVE-2014-0446

CVE-2014-0446 is an Oracle Java SE vulnerability described as unspecified, affecting Libraries in Java SE 5.0u61, 6u71, 7u51, 8 and Java SE Embedded 7u51. The IBM and related bulletins enumerate this CVE among a broader set of Java CPU fixes, with affected IBM SDK/JAVA editions and WebSphere/Info...

CVE-2019-0211

CVE-2019-0211 affects Apache HTTP Server 2.4.17–2.4.38 when using MPM event, worker, or prefork. The issue arises from code executing in less-privileged child processes/threads (including in-process scripting interpreters) that could be exploited to run arbitrary code with the privileges of the p...

CVE-2019-6111

OpenSSH SCP client vulnerability CVE-2019-6111: in OpenSSH 7.9, the SCP client does not properly validate the object name returned by the server, allowing a malicious SCP server or MITM to overwrite arbitrary files in the client target directory. If recursive transfers (-r) are used, subdirectori...

CVE-2023-5129

CVE-2023-5129 entry was rejected/withdrawn and is not an active vulnerability.

CVE-2023-39848

CVE-2023-39848 is rejected/not used; this CVE ID does not represent an active vulnerability entry.

CVE-2023-25180

CVE-2023-25180 is a GLib2 vulnerability described in connected advisories as a denial-of-service issue caused by processing a malicious text-form variant, enabling looping or resource exhaustion. Affected products reference GLib2 packages (glib2) across multiple Linux distributions; upstream note...

CVE-2010-4478

OpenSSH

CVE-2023-24593

CVE-2023-24593 is a GLib2 vulnerability described in connected advisories as a DoS caused by GLib handling of non-normal GVariants (text-form variant) that can crash or degrade service when a malicious input is processed. Affected advisories reference multiple vendor advisories (e.g., IBM/EulerOS...

CVE-2021-28041

The CVE refers to OpenSSH ssh-agent before 8.5, where a double-free vulnerability may be triggered in rare scenarios (unconstrained agent-socket access on legacy OS or forwarding to an attacker-controlled host). Affected component: ssh-agent in OpenSSH prior to 8.5. Root cause: double free descri...

CVE-2018-15919

CVE-2018-15919 affects OpenSSH up to version 7.8, where Remotely observable behaviour in auth-gss2.c could allow a remote attacker to enumerate existing usernames when GSS2 is used. The IBM/linked bulletin explicitly notes the discoverer’s statement that username enumeration is not treated as a v...

CVE-2015-5600

Summary (CVE-2015-5600): The kbdint_next_device function in OpenSSH sshd up to version 6.9 fails to properly constrain keyboard-interactive device processing within a single connection, enabling remote brute-force attempts or a denial-of-service via a long/duplicative ssh -oKbdInteractiveDevices ...

CVE-2023-22512

CVE-2023-22512 is a DoS vulnerability in Atlassian Confluence Data Center and Server. Introduced in version 5.6, it allows an unauthenticated, network-based attacker to make a Confluence instance unavailable, with no impact to confidentiality or integrity and a high availability impact (CVSS v3.1...

CVE-2022-28748

CVE-2022-28748 is rejected/not used; reference CVE-2022-2964 instead; this ID is not active.

CVE-2023-1648

CVE-2023-1648 is rejected/not used; reference CVE-2023-0326.

CVE-2020-11984

CVE-2020-11984 affects Apache HTTP Server mod_proxy_uwsgi. Based on the provided documents, it is a vulnerability in httpd’s uwsgi handling that can lead to information disclosure and potentially remote code execution. The vulnerability was reported for Apache HTTP Server versions around 2.4.32 t...

CVE-2022-1480

CVE-2022-1480 has been withdrawn. The initial entry shows a “Rejected reason” indicating it is not a security issue, and a connected CNNVD record explicitly states that this CVE number has been withdrawn. Across the provided documents there are no concrete, active vulnerability details (no confir...

CVE-2022-3757

CVE-2022-3757 is rejected/not used; this entry does not represent an active vulnerability.

CVE-2022-3772

CVE-2022-3772 relates to a cross-site request forgery in easyii CMS affecting the /admin/sign/out function. The vulnerability can be triggered remotely and is described across multiple sources (PT-2022-24047, CNNVD-202210-2536, EUVD entries) as a CSRF in easyii CMS with unknown affected versions;...

CVE-2022-24087

CVE-2022-24087 is the follow-on to CVE-2022-24086, an Improper Input Validation vulnerability in Adobe Commerce/Magento Open Source that enables pre-authenticated remote code execution. Connected sources indicate it affects Magento Open Source/Adobe Commerce 2.3.3-p1–2.3.7-p2 and 2.4.0–2.4.3-p1, ...

CVE-2022-4083

CVE-2022-4083 is rejected and not used as stated in the Initial Description.

CVE-2023-50868

CVE-2023-50868 is a DNSSEC-related denial of service issue (NSEC3 Closest Encloser proof) that can cause CPU exhaustion. The connected documents confirm impact on DNS implementations such as Unbound and BIND/BIND9 and describe the root cause as processors performing thousands of hash iterations f...

CVE-2023-22514

CVE-2023-22514 affects Sourcetree for Mac and Sourcetree for Windows (version 3.4.14). The vulnerability is a Remote Code Execution (RCE) flaw exploitable by an unauthenticated attacker via user interaction, with a CVSS base score of 7.8 (Impact: Confidentiality, Integrity, Availability high; Att...

CVE-2022-4085

CVE-2022-4085 entry is rejected and not an active vulnerability entry.