CVE-2024-7254

CVE-2024-7254 describes a stack overflow DoS in parsers when handling untrusted Protocol Buffers data with deeply nested SGROUP/group structures. The root cause is unbounded recursion when parsing unknown fields (DiscardUnknownFieldsParser) or Java Protobuf Lite against nested groups or map field...

CVE-2024-26816

CVE-2024-26816 affects the Linux kernel on x86 where, when CONFIG_XEN_PV=y, .text symbols are emitted into the .notes section. Relocations in .notes were previously possible and could leak the KASLR base via /sys/kernel/notes. The fixes instruct the kernel to skip performing relocations in the .n...

CVE-2024-26861

CVE-2024-26861 affects the Linux kernel wireguard receive path, where a data race around keypair->receiving_counter.counter was identified (READ_ONCE/WRITE_ONCE annotations used to mark the race as intentional). The race occurs between wg_packet_decrypt_worker and wg_packet_rx_poll, potentiall...

CVE-2023-40085

CVE-2023-40085 involves a missing bounds check in ShimConverter.cpp, in the function convertSubgraphFromHAL , which can trigger a possible out-of-bounds read. This leads to local information disclosure with no additional execution privileges required and no user interaction. The connected documen...

CVE-2021-46956

CVE-2021-46956 : In the Linux kernel, a memory leak in virtiofs was fixed. When the same tag was passed twice to qemu, virtio_fs_probe() leaked kmemleak-tracked memory, evidenced by a log line like “virtiofs: probe of virtio5 failed with error -17.” The issue is located in the virtiofs subsystem ...

CVE-2023-40105

CVE-2023-40105 affects the Android framework (ActivityManagerService), specifically in backupAgentCreated. The root cause is a missing permission check in this path, enabling local information disclosure. The impact is high confidentiality loss with no integrity or availability impact described, ...

CVE-2024-22369

Apache Camel's SQL Component contains a deserialization of untrusted data vulnerability (CWE-502) within the JDBCAggregationRepository component. The root cause is insufficient validation of serialized objects, which can allow a remote attacker to execute arbitrary code on the system by sending a...

CVE-2023-42951

CVE-2023-42951 pertains to Apple’s Safari in iOS 17.1 and iPadOS 17.1. The issue stems from improved handling of caches, and can cause a user to be unable to delete browsing history items. Multiple sources (Apple security notes, NVD entry, Red Hat advisory) confirm the vulnerability is addressed ...

CVE-2024-21726

The Joomla! Content Management System (CMS) is affected by CVE-2024-21726 , a vulnerability where inadequate content filtering within the framework's filter code allows for Cross-Site Scripting (XSS) in various components. Researchers have indicated that attackers could potentially achieve remote...

CVE-2024-25841

The **

CVE-2023-42843

CVE-2023-42843 involves an inconsistent user interface issue in Apple products, specifically within iOS , iPadOS , Safari , and macOS Sonoma . The vulnerability is caused by improper state management and may allow address bar spoofing when a user visits a malicious website. This issue is addresse...

CVE-2023-52381

A script injection vulnerability exists in the Huawei HarmonyOS and EMUI mail modules. An attacker can exploit this flaw to execute arbitrary code on the system, potentially impacting the confidentiality, integrity, and availability of services. No specific exploit links or patch versions are pro...

CVE-2023-40112

CVE-2023-40112 describes a likely out-of-bounds read in the printer subsystem: the function ippSetValueTag in ipp.c performs a missing bounds check, potentially allowing local disclosure of past print jobs or other print-related data. Exploitation is described as local (no remote access) with no ...

CVE-2024-0016

CVE-2024-0016 is an Android/Bluetooth-related issue described as an out-of-bounds read caused by a missing bounds check. It could lead to disclosure of paired device information without any user interaction or privileges. The connected documents confirm the vulnerability exists in multiple locati...

CVE-2023-42953

CVE-2023-42953 is an Apple ecosystem vulnerability describing a permissions issue that could allow an app to access sensitive user data. The connected sources specify remediation in updated versions across multiple Apple platforms: tvOS 17.1, watchOS 10.1, iOS 17.1, iPadOS 17.1, and macOS Sonoma ...

CVE-2024-1669

CVE-2024-1669 affects Blink in Google Chrome and is fixed by upgrading to Chrome 122.0.6261.57. The vulnerability is an out-of-bounds memory access in Blink that could be triggered by a crafted HTML page, allowing a remote attacker to access memory. The CVE is documented with a high severity in t...

CVE-2024-37032

Ollama versions before 0.1.34 are vulnerable to a path traversal vulnerability (CWE-22 ) within the model pull mechanism. The root cause is a failure to validate the format of the digest field in OCI manifests, allowing attackers to inject path traversal sequences (e.g., ../) during the GetBlobsP...

CVE-2023-42946

This vulnerability in Apple products involves an application's ability to leak sensitive user information . The issue was addressed through improved redaction of sensitive information. Affected platforms include tvOS 17.1 , watchOS 10.1 , macOS Sonoma 14.1 , iOS 17.1 , and iPadOS 17.1 . No specif...

CVE-2024-22778

The real-time collaborative note-taking application HackMD CodiMD is vulnerable to a Denial of Service (DoS) attack in versions prior to 2.5.2 . This vulnerability allows an attacker to disrupt the availability of the service. Remediation is available by updating to version 2.5.2 or later . Explo...

CVE-2022-20648

CVE-2022-20648 affects Cisco StarOS Software’s Redundancy Configuration Manager (RCM). A debug service incorrectly listens to/accepts incoming connections, enabling an unauthenticated, remote attacker to connect to the debug port, execute commands, and view confidential debugging information. Cis...

CVE-2024-21722

The Joomla! content management system is affected by a vulnerability where the MFA management features fail to properly terminate existing user sessions when a user's MFA methods are modified. This insufficient session expiration could allow an attacker to maintain access to a session even after ...

CVE-2023-42834

CVE-2023-42834 affects Apple platforms (iOS 17.1, iPadOS 17.1, macOS Monterey 12.7.2, macOS Ventura 13.6.3, macOS Sonoma 14.1, watchOS 10.1). The issue is a privacy flaw caused by improved handling of files, which may allow an app to access sensitive user data. Fixed in the indicated OS versions:...

CVE-2024-26282

A cross-site scripting (XSS) vulnerability exists in Mozilla Firefox for iOS versions prior to 123 . By using an AMP URL containing a canonical element , an attacker could execute malicious JavaScript from an opened bookmarked page. This flaw could allow an attacker to obtain the victim's cookie-...

CVE-2023-42823

CVE-2023-42823 affects Apple platforms (iOS/iPadOS/watchOS/macOS/tvOS). The issue arises from logging sanitization that allows an app to access user-sensitive data via log entries. Affected versions include iOS 16.7.2 and 17.1, iPadOS 16.7.2 and 17.1, watchOS 10.1, tvOS 17.1, macOS Sonoma 14.1, m...

CVE-2011-5257

Classipress (WordPress theme) before 3.1.5 is affected by multiple XSS vulnerabilities via twitter_id and facebook_id widget parameters, and similar stored XSS risk via POST facebook_id/twitter_id in user profiles (

CVE-2021-47068

The CVE-2021-47068 entry concerns the Linux kernel NFC LLCP paths (llcp_sock_bind/llcp_sock_connect). Root cause: a refcount leak in bind/connect was fixed but introduced a use-after-free when the same local is bound to two sockets. The vulnerability is tied to the NFC LLCP implementation in the ...

CVE-2021-47013

The CVE-2021-47013 issue is a Linux kernel use-after-free in net:emac/emac-mac, specifically in emac_mac_tx_buf_send where a freed skb could still be accessed via skb->len. The fix (cited in the description) assigns skb->len to a local len before freeing and uses len thereafter to avoid ref...

CVE-2023-52380

An improper access control vulnerability exists in the mail module of Huawei HarmonyOS and EMUI . An attacker could exploit this flaw to obtain sensitive information , potentially affecting service confidentiality . No specific affected versions, root causes, or remediation details are provided i...

CVE-2024-21725

The Joomla! Content Management System (CMS) is vulnerable to Cross-Site Scripting (XSS) due to the inadequate escaping of mail addresses in various components. An attacker could input data into an email address field that, if not properly escaped, is interpreted as HTML code, leading to the execu...

CVE-2023-52361

The CVE-2023-52361 entry corresponds to Huawei HarmonyOS VerifiedBoot module authentication errors. Multiple sources (NVD, CNVD, CNNVD) describe a vulnerability in the VerifiedBoot component that can compromise system integrity (I = High) with no confidentiality or availability impact, and with n...

CVE-2023-52378

CVE-2023-52378 relates to Huawei HarmonyOS/EMUI WMS (WindowManagerServices) with an incorrect service logic root cause in the WMS module. The connected CNVD/CNNVD entries describe a privilege control type vulnerability and a business logic error that can lead to usability issues or functional exc...

CVE-2021-47005

CVE-2021-47005 affects the Linux kernel PCI Express endpoint subsystem. The vulnerability arises from get_features() returning NULL in pci_epc_ops, leading to a NULL pointer dereference in pci_epf_test_alloc_space. The fix adds a NULL check for the pci_epc_feature pointer in pci_epf_test_bind and...

CVE-2021-47017

The CVE-2021-47017 vulnerability is in the Linux kernel's ath10k_htc_send_bundle path, where a use-after-free could occur if bundle_skb is freed by dev_kfree_skb_any(bundle_skb) but later accessed via bundle_skb->len. The patch mitigates this by updating skb_len after freeing bundle_skb. Affec...

CVE-2010-0425

CVE-2010-0425 affects Apache HTTP Server on Windows with ISAPI module mod_isapi (DLLs in 2.0.37–2.0.63, 2.2.0–2.2.14, and 2.3.x before 2.3.7). Root cause: mod_isapi may unload an ISAPI DLL before request processing finishes, causing memory corruption. Impact: remote code execution or denial of se...

CVE-2023-5388

The NSS library is susceptible to a timing side-channel attack during RSA decryption , which could allow an attacker to recover private data. This vulnerability affects Firefox < 124 , Firefox ESR < 115.9 , and Thunderbird

CVE-2020-36787

Summary of CVE-2020-36787 (Linux kernel, Aspeed video clock handling) The issue affects the Video Engine clock management in Aspeed-based platforms (e.g., AST2500 SoCs) where the Video Engine reset was coupled with the eclk reset sequence. The documented sequence (enable eclk → de-assert Video En...

CVE-2023-49100

Trusted Firmware-A (TF-A) before version 2.10 is vulnerable to a potential read out-of-bounds in the SDEI service . The root cause is insufficient validation of the input parameter passed in register x1 within the sdei_interrupt_bind function, which is subsequently used in a call to plat_ic_get_i...

CVE-2024-26957

CVE-2024-26957 relates to the Linux kernel’s s390/zcrypt subsystem, where reference counting on zcrypt card objects was fixed to prevent a use-after-free of the zcrypt_card during hot-plug/probe/remove cycles. The issue could allow freeing a zcrypt card object while it is still in use, as demonst...

CVE-2023-42855

The CVE-2023-42855 entry concerns iOS 17.1 / iPadOS 17.1. The issue arises from a design/logic flaw that could allow an attacker with physical access to silently persist an Apple ID on a device that has been erased. Apple’s description indicates this was addressed by improved state management and...

CVE-2022-48828

CVE-2022-48828 – Linux kernel (NFSD: Fix ia_size underflow) The vulnerability stems from a signed 64-bit i/o field (ia_size) being used to store an NFS file size defined as unsigned 64-bit, allowing an underflow when large values are sent by NFS clients. The issue is fixed in the common code path...

CVE-2024-25197

Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions are vulnerable to a NULL pointer dereference within the isCurrent() function located at /src/layered_costmap.cpp. This flaw impacts the navigation capabilities of the system. As a temporary workaround, it is recommended to d...

CVE-2023-52583

The CVE-2023-52583 entry describes a Linux kernel issue in the ceph component where dget() usage could lead to a deadlock due to incorrect lock ordering between dentry and its parent. The dead code path was never used because the parent directory is always supplied by callers, so the fix removes ...

CVE-2021-47009

CVE-2021-47009 relates to the Linux kernel KEYS: trusted subsystem. The issue is a memory leak in the object td where two error return paths failed to free td, leading to leaked memory. The fix changes control flow to return via an error path that securely frees td with kfree. The description als...

CVE-2021-47022

The CVE-2021-47022 issue concerns the Linux kernel driver for mt76 mt7615. The vulnerability is a memory leak that occurs in the mt7615 unregister path, specifically relating to the order of cleanup calls: mt7615_tx_token_put() should be invoked before mt76_free_pending_txwi(). A patch fixes meml...

CVE-2021-46987

CVE-2021-46987: Linux kernel/btrfs deadlock when cloning inline extents with qgroups. Root cause: while cloning, a transaction flush can occur with destination iotree range locked and delalloc flush needing the same range, potentially deadlocking. This occurs specifically when qgroups reserve met...

CVE-2017-7668

The Apache httpd server is vulnerable to a buffer over-read in the ap_find_token() function. This issue originated from HTTP strict parsing changes introduced in versions 2.2.32 and 2.4.24 . A remote attacker can exploit this by sending a maliciously crafted sequence of request headers, potential...

CVE-2021-47003

CVE-2021-47003 concerns the Linux kernel’s dmaengine idxd path. A null pointer dereference could occur when code calls idxd_cmd_exec with a null status pointer; a later assignment to *status could dereference a null. The fix is to perform a null check on status before the assignment, preventing t...

CVE-2021-47042

CVE-2021-47042: Linux kernel drm/amd/display fixes a memory leak in dc_link_construct() by freeing local data after use. The description includes stack backtrace and memory object details; no connected documents with exploit specifics are provided, monitor for updates and apply upstream fix when ...

CVE-2021-47030

CVE-2021-47030 affects the Linux kernel MT76/MT7615: a memory leak in the mt7615_coredump_work path has been fixed (similar to the mt7921_coredump_work fix). The fix addresses a local-impact leak with HIGH availability impact; no exploitation details are provided in the supplied documents, and up...

CVE-2021-46998

Summary: CVE-2021-46998 affects the Linux kernel, specifically the enic driver path in ethernet/enic. A use-after-free occurs in enic_hard_start_xmit when an error in enic_queue_wq_skb() frees a skb via dev_kfree_skb(skb), but skb_tx_timestamp(skb) may still access it. Root cause: freed skb used ...