408016 matches found
CVE-2023-1428
CVE-2023-1428: gRPC for C++ is affected by a denial of service due to specific HTTP/2 header handling. When certain headers (for example te: x; :scheme: x; grpclb_client_stats: x) are sent and the total header size exceeds 8 KB, gRPC’s C++ implementation can abort(). The vulnerability is a NETWOR...
CVE-2024-26994
CVE-2024-26994 – Linux kernel speakup crash on very long words : The issue occurs when a console is configured with a word longer than 256 characters, risking a crash due to buffer length overflow. The fixed version stops processing before the word buffer length is exceeded. Affected component: s...
CVE-2023-42858
CVE-2023-42858 affects Apple macOS: an app may access user-sensitive data due to a prior access-control issue. It is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, and macOS Ventura 13.6.1. The issue is described as addressed with improved checks; no exploit details are provided in the connec...
CVE-2023-32187
CVE-2023-32187 describes an “Allocation of Resources Without Limits or Throttling” vulnerability in SUSE k3s. Remote/unauthenticated actors who can access the K3s apiserver/supervisor port (TCP 6443) may cause a denial of service by improper resource throttling. Affected k3s releases include: v1....
CVE-2011-5000
OpenSSH
CVE-2023-22044
CVE-2023-22044 affects OpenJDK/OpenJDK-based runtimes (e.g., Debian openjdk-17, AlmaLinux java-17-openjdk) as part of the July 2023 Java updates. Connected advisories confirm it is among multiple OpenJDK vulnerabilities and are addressed by updates to OpenJDK 17 (e.g., 17.0.8) across distribution...
CVE-2024-50349
CVE-2024-50349 affects Git. When prompting for credentials in terminal (no credential helper), Git decodes URL-encoded parts and prints the host; attackers can craft URLs with ANSI escape sequences to mislead users. The issue was patched via commits 7725b81 and c903985 and is addressed in multipl...
CVE-2018-7600
CVE-2018-7600 (Drupalgeddon2) is a remote code execution vulnerability in Drupal core. Public details confirm it affects: Drupal 7.x up to 7.57/7.58; Drupal 8.x up to 8.3.8/8.3.9; 8.4.x up to 8.4.5/8.4.6; 8.5.x up to 8.5.0/8.5.1, with default or common module configurations. The root cause involv...
CVE-2023-3518
HashiCorp Consul and Consul Enterprise 1.16.0 had a vulnerability in JWT-based service-mesh authentication that allowed or denied access independent of service identities. The issue is fixed in version 1.16.1. No exploitation details are provided in the connected documents. Affected product/versi...
CVE-2024-27073
CVE-2024-27073 (Linux kernel) relates to memory leaks in the media: ttpci budget_av_attach path. The fixes ensure budget_av_attach frees resources if saa7146_register_device or saa7146_vv_init fail, aligning with the error-handling pattern in ttpci_budget_init. Two fixme comments noted deallocati...
CVE-2023-0872
OpenNMS Horizon CVE-2023-0872 affects Horizon REST API users endpoint in Horizon 31.0.8 and older than 32.0.2, enabling privilege elevation (to admin) via REST. The issue stems from role escalation between ROLE_REST and ROLE_ADMIN when accessing /rest/users, with confirmed guidance that upgrading...
CVE-2021-0447
CVE-2021-0447 entry is rejected/not used per the description.
CVE-2025-1243
Temporal api-go library prior to v1.44.1 fails to send update response data to Data Converter when used in a gRPC proxy during UpdateWorkflowExecution, causing incomplete Data Converter transformations (e.g., encryption) on the update response field. This occurs only when using the UpdateWorkflow...
CVE-2024-52006
Git vulnerability CVE-2024-52006 involves newline confusion in credential helpers that use a line-based protocol. Some environments (notably .NET and Node.js) may treat a single Carriage Return as a newline, bypassing protections for credential helpers that rely on CR handling. The issue has been...
CVE-2023-20214
Cisco SD-WAN vManage REST API authentication validation vulnerability (CVE-2023-20214) allows unauthenticated remote attackers to read or partially modify configuration due to insufficient REST API request validation. Affected product: Cisco SD-WAN vManage (REST API surface only; web UI/CLI unaff...
CVE-2021-34859
CVE-2021-34859 affects TeamViewer 15.16.8.0. The issue stems from improper validation during parsing of TVS files, leading to memory corruption that enables remote code execution in the context of the current process. Exploitation requires user interaction (the target opens a malicious file or vi...
CVE-2014-1692
CVE-2014-1692 affects OpenSSH up to version 6.4 when Makefile.inc enables J-PAKE; the hash_buffer function in schnorr.c may not initialize certain data structures, enabling remote attackers to trigger a memory corruption denial of service (and potentially other impact). The provided documents do ...
CVE-2024-53845
CVE-2024-53845 concerns ESPRESSIF ESP-IDF’s ESPTouch v2 AES/CBC encryption where the Initialization Vector (IV) was not configurable prior to versions 5.3.2, 5.2.4, 5.1.6, and 5.0.8, causing a deterministic ciphertext and potential data leakage. The fixed behavior, implemented in these versions, ...
CVE-2024-3656
The issue CVE-2024-3656 affects Keycloak prior to 24.0.5, where several admin REST API endpoints allow low-privilege users to perform administrator actions. The root cause is broken access control enabling authenticated non-admin users to access functionalities intended for admins, potentially le...
CVE-2024-56734
CVE-2024-56734 affects Better Auth (TypeScript) prior to version 1.1.6, where the verify-email endpoint accepts a callbackURL parameter and uses JWT without proper domain validation. This open-redirect flaw can allow an attacker to redirect users to arbitrary, attacker-controlled sites. Root caus...
CVE-2024-2609
A clickjacking vulnerability exists in Firefox , Firefox ESR , and Thunderbird because the permission prompt input delay can expire while the window is out of focus. This condition allows malicious websites to trick users into performing unintended actions. The issue affects Firefox < 124 , Fi...
CVE-2023-4785
CVE-2023-4785: Google gRPC core flaw — lack of error handling in the TCP server on posix platforms (e.g., Linux) can cause DoS when many connections are opened. Affected: gRPC C++, Python, Ruby (not Java/Go). Upgrades exist: CBLMariner advises grpc >= 1.62.0-2; IBM advisories for Cloud Pak for...
CVE-2024-34932
The Campcodes Complete Web-Based School Management System version 1.0 contains a SQL injection vulnerability in the /model/update_exam.php API endpoint. An attacker can exploit this by providing malicious input via the name parameter to execute arbitrary SQL commands. As a temporary workaround, i...
CVE-2023-42938
The CVE-2023-42938 entry concerns Apple iTunes for Windows prior to version 12.13.1, where a logic issue could allow a local user to elevate privileges. The vulnerability is described across multiple Connected documents as a local privilege escalation affecting iTunes on Windows, caused by insuff...
CVE-2024-52008
Fides (open-source privacy engineering platform) has a password policy bypass in its invite flow. The /api/v1/user/accept-invite endpoint does not enforce the server-side password policy, allowing an invited user to set an arbitrarily weak password during initial account setup despite UI client-s...
CVE-2024-27054
A vulnerability exists in the Linux kernel involving a double module refcount decrement in the s390/dasd component. The issue occurs because manual decrementing along an error path causes the refcount to decrease artificially on every error, whereas it should remain unchanged once a discipline is...
CVE-2024-26880
CVE-2024-26880 relates to the Linux kernel vulnerability where dm: call the resume method on internal suspend was improperly paired, risking a crash via a list corruption in the DM (device-mapper) subsystem during suspend/resume handling. The fix standardizes calls by having __dm_internal_resume ...
CVE-2016-10009
OpenSSH/OpenSSH-ssh-agent PKCS#11 path trust issue (CVE-2016-10009) is still referenced in connected documents as an incomplete fix leading to remote code execution when an agent is forwarded to an attacker-controlled system. Astra Linux notes: The vulnerability is due to an insufficiently trustw...
CVE-2024-34397
A vulnerability exists in GNOME GLib (specifically the GDBus signal subscription mechanism) before versions 2.78.5, 2.79.x before 2.80.1, and other affected distributions. A local attacker can spoof D-Bus signals that a GDBus-based client (such as those interacting with NetworkManager ) will wron...
CVE-2024-26950
CVE-2024-26950 (WireGuard, Linux kernel) : The issue was in the netlink path for WireGuard where the code accessed the device via peer and could dereference a NULL peer->device. The fix standardizes device retrieval from the context by using ctx->wg, since ctx->wg->peer_allowedips.seq...
CVE-2023-1108
CVE-2023-1108 affects Undertow within Red Hat JBoss EAP 7.3.x (SSLConduit) where an infinite loop on close can cause DoS. Connected RHSA-2025-9583 confirms the issue and indicates a fix in the eap-7.3.z line (Patched Undertow). Remediation is to upgrade to the patched EAP 7.3.x release (eap-7.3.z...
CVE-2023-35082
CVE-2023-35082 describes an authentication bypass in Ivanti EPMM 11.10 and older, allowing unauthenticated access to restricted API functionality. The vulnerability is tied to Ivanti EPMM/MobileIron Core deployments and is documented as an authentication bypass that enables unauthorized access to...
CVE-2024-26889
A buffer overflow vulnerability exists in the Linux kernel within the Bluetooth: hci_core component. The issue stems from the struct hci_dev_info structure, which contains a fixed-size name[8] field. If hdev->name exceeds this size, the strcpy function attempts to write past the buffer boundar...
CVE-2017-11882
CVE-2017-11882 is a memory corruption vulnerability in Microsoft Office's Equation Editor that affects Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016. The flaw resides in eqnedt32.exe, an out-of-process COM server, and can lead to remote code execution when a user opens a specially crafted Word do...
CVE-2023-39153
CVE-2023-39153 is a CSRF vulnerability in Jenkins GitLab Authentication Plugin versions ≤ 1.17.1. The flaw allows an attacker to lure a logged-in user into authenticating to the attacker’s account, via a crafted request, effectively abusing the OAuth flow. The root cause is the plugin’s lack of a...
CVE-2021-34527
CVE-2021-34527, known as PrintNightmare, is a Windows Print Spooler remote code execution vulnerability. The flaw allows an authenticated attacker to execute arbitrary code with SYSTEM privileges by abusing privileged file operations in the Print Spooler, enabling installation of programs, data a...
CVE-2007-6750
CVE-2007-6750 affects Apache HTTP Server 1.x and 2.x. The vulnerability arises from handling partial HTTP requests (Slowloris), related to absence of the mod_reqtimeout protection in versions before 2.2.15, enabling remote DoS (daemon outage). Public details in connected docs confirm PoCs/exploit...
CVE-2024-26940
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Create debugfs ttmresourcemanager entry only if needed The driver creates /sys/kernel/debug/dri/0/mobttm even when the corresponding ttmresourcemanager is not allocated. This leads to a crash when trying to read from...
CVE-2021-44224
CVE-2021-44224 concerns Apache HTTP Server (httpd) with the mod_proxy forward proxy configuration. A crafted URI to a forward proxy (ProxyRequests on) can trigger a NULL pointer dereference, causing a crash. In configurations that mix forward and reverse proxy declarations, it can enable requests...
CVE-2025-24976
Distribution’s token authentication flaw (CVE-2025-24976) affects registry versions 3.0.0-beta.1 through 3.0.0-rc.2 with token auth enabled. The root cause: JWT JWK verification accepts a header with a certificate chainless JWK but only validates the KeyID against trusted keys, not the actual key...
CVE-2024-53240
The CVE-2024-53240 entry refers to a Xen netfront crash in the Linux kernel. The issue occurs when removing a netfront device directly after a suspend/resume cycle, where queues may not be reinitialized and a crash can happen when stopping them. The fix is to check that the queues exist before st...
CVE-2023-2728
CVE-2023-2728 : The vulnerability allows containers to bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when ephemeral containers are used. Kubernetes clusters are affected only if both the ServiceAccount admission plugin and the annotation kubernetes.io/enforce...
CVE-2019-3571
WhatsApp Desktop versions prior to 0.3.3793 are affected by an input validation issue that allows malicious clients to send files to users that would be displayed with a wrong extension. Root cause: input validation weakness. Supported by multiple sources (NVD/NVD-linked CVE records). No exploit ...
CVE-2024-53148
CVE-2024-53148 affects the Linux kernel (comedi subsystem). The issue: if remap_pfn_range() calls partially succeed before a failure, some buffer pages remain mapped in userspace page tables after dropping the buffer reference, and cleanup occurs too late in the mmap error path. The root cause is...
CVE-2026-60002
Summary (CVE-2026-60002): OpenSSH
CVE-2023-34644
CVE-2023-34644 is a remote code execution vulnerability in Ruijie Networks products. A crafted POST to /cgi-bin/luci/api/auth allows unauthorized remote attackers to gain the highest privileges. Affected products and versions include Ruijie RG-EW series (EW_3.0(1)B11P204), RG-NBS and RG-S1930 ser...
CVE-2024-26894
The Linux kernel contains a memory leak vulnerability in the ACPI: processor_idle component, specifically within the acpi_processor_power_exit() function. The issue occurs because memory associated with the CPU idle device is not freed after unregistering it. This can lead to a memory leak over t...
CVE-2024-27393
CVE-2024-27393 affects the Linux kernel xen-netfront driver. A missing skb_mark_for_recycle() call led to memory leak in page_pool handling (page_pool_release_page() usage and subsequent removals). The issue was fixed by adding the missing skb_mark_for_recycle in xen-netfront, with historical con...
CVE-2024-26956
CVE-2024-26956 covers a kernel vulnerability in nilfs2 within the Linux kernel. The issue has two flaws: (1) nilfs_get_block() may misinterpret a DAT-corrupted data block as existing, due to DAT translation returning -ENOENT; and (2) after this inconsistency, the caller may request a read on an u...