379427 matches found
CVE-2020-26137
CVE-2020-26137 pertains to Python’s urllib3 and is explicitly described as a CRLF injection vulnerability in the HTTP request handling of urllib3/http.client. The connected advisories show affected package and version details: python-urllib3 1.24.2-2 (CBLMariner entry) and a recommended upgrade t...
CVE-2020-36518
CVE-2020-36518 affects jackson-databind prior to 2.13.0, enabling a Java StackOverflow and DoS via excessive nesting depth. In affected advisories, remediation is to upgrade jackson-databind to 2.13.0+ (examples show 2.13.x or newer such as 2.13.4.2 in Crowd/CWD references). Practical impact is d...
CVE-2022-29241
CVE-2022-29241 affects Jupyter Server (backend for Jupyter web apps) prior to 1.17.1. If notebook_server is started with root_dir containing the starting user’s home directory, an authenticated user can leak the start-time access token via the REST API by guessing/brute-forcing the server PID. Th...
CVE-2018-4990
Adobe Acrobat and Reader (various 2015–2018 era builds) contain a Double Free vulnerability in the JavaScript engine that could allow arbitrary code execution in the context of the current user when exploited. Affected versions include 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2...
CVE-2015-2502
CVE-2015-2502 affects Internet Explorer 7–11 and is a memory-corruption vulnerability triggered by visiting a crafted web site. The issue allows remote code execution (or DoS) and was exploited in the wild around August 2015. Public documentation identifies the affected software as Internet Explo...
CVE-2022-4450
Summary (CVE-2022-4450): OpenSSL’s PEM_read_bio_ex() and wrappers PEM_read_bio()/PEM_read() are vulnerable. If a PEM file is crafted to trigger a 0-byte payload, PEM_read_bio_ex() may return a failure while its header buffer has already been freed; freeing that buffer again can cause a use-after-...
CVE-2018-20406
CVE-2018-20406 affects Python’s pickle handling: an integer overflow in Modules/_pickle.c when resizing with a large LONG_BINPUT can cause memory exhaustion. The issue is triggered when serializing tens-to-hundreds of gigabytes of data via pickle. Affected Python versions include older 3.x branch...
CVE-2009-1891
CVE-2009-1891 affects the Apache HTTP Server mod_deflate in 2.2.x (notably 2.2.11 and earlier). The issue causes CPU consumption DoS by compressing large files even after the client connection closes. Public advisories across distributions confirm the flaw and its remediation via updated packages...
CVE-2022-22215
CVE-2022-22215 describes a Denial of Service in Junos OS and Junos OS Evolved due to a missing release of file descriptors/handles after a gRPC connection ends. The root cause is that /var/run/.env files may not be deleted when a gRPC session terminates, potentially exhausting inodes. Affected pr...
CVE-2024-51545
CVE-2024-51545 affects ABB ASPECT - Enterprise v3.08.02, NEXUS Series v3.08.02, and MATRIX Series v3.08.02. The issue is a username enumeration vulnerability that allows access to application-level username add, delete, modify and list functions. Root cause details are not fully specified in the ...
CVE-2022-39324
Grafana prior to versions 8.5.16 and 9.2.8 is affected by CVE-2022-39324, where a malicious user can craft a snapshot URL to mislead other users via an attacker-injected originalUrl. The vulnerability arises from a web proxy-related query editing, causing the Open original dashboard button to poi...
CVE-2014-4123
CVE-2014-4123 affects Microsoft Internet Explorer 7–11. The vulnerability allows remote attackers to gain privileges via a crafted web site (elevation of privilege). Exploitation in the wild was noted in October 2014 (per the CVE description). Mitigation: apply the MS14-056 cumulative update for ...
CVE-2022-20809
Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) have a CVE-2022-20809 vulnerability in their API and web-based management interfaces that could allow an authenticated, remote attacker to write files or disclose sensitive information on an affected device. The issue...
CVE-2016-6367
The CVE-2016-6367 issue affects Cisco ASA Software on ASA 5500/5500-X, PIX, and FWSM where an authenticated, local attacker can trigger the CLI parser with invalid commands to gain privileges and potentially execute code or cause DoS. The root cause is improper handling of invalid CLI input in th...
CVE-2013-5704
CVE-2013-5704 concerns the Apache HTTP Server mod_headers trailer-header bypass vulnerability. The issue arises when a client places headers in the trailer portion of a chunked request, potentially bypassing RequestHeader unset directives and allowing header manipulation after header processing. ...
CVE-2024-39573
The CVE-2024-39573 entry corresponds to Apache HTTP Server mod_rewrite/mod_proxy SSRF-related risk and is confirmed by connected sources reporting the issue in Apache httpd 2.4.59 and earlier, with a fix in 2.4.60 (and later 2.4.61 in later advisories). Root cause: unsafe RewriteRules/Substitutio...
CVE-2020-3441
Cisco Webex Meetings and Cisco Webex Meetings Server are affected by CVE-2020-3441, a information-disclosure vulnerability caused by insufficient protection of sensitive participant information. An unauthenticated, remote attacker could browse the Webex roster and obtain details such as email and...
CVE-2015-2360
CVE-2015-2360 is a local privilege-escalation in Windows kernel-mode driver Win32k.sys affecting multiple Windows versions (Server 2003 SP2/R2 SP2, Vista SP2, Server 2008 SP2/R2 SP1, Windows 7 SP1, 8/8.1, Server 2012/2012 R2, RT/RT 8.1). The underlying issue is in Win32k.sys that allows crafted a...
CVE-2025-62718
Axios prior to 1.15.0 has a hostname normalization flaw when evaluating NO_PROXY rules. Requests to loopback addresses (e.g., localhost with a trailing dot or IPv6 [::1]) can bypass NO_PROXY and be routed through the configured proxy. This bypass enables potential proxy circumvention and SSRF aga...
CVE-2024-48310
The CVE-2024-48310 entry concerns AutoLib Software Systems OPAC v20.10, where multiple API keys are exposed in the source code (e.g., main.js) allowing potentially unauthorized access to the backend API or other sensitive information. Affected component: API keys embedded in the codebase; exploit...
CVE-2022-47986
Summary: CVE-2022-47986 affects IBM Aspera Faspex 4.4.2 PL1 and earlier due to a YAML deserialization flaw that allowed remote code execution. The vulnerability is triggered by a specially crafted obsolete API call; the obsolete call was removed in Faspex 4.4.2 PL2. IBM’s bulletin confirms remedi...
CVE-2022-23457
CVE-2022-23457 affects ESAPI (OWASP Enterprise Security API) Java legacy. The default implementation of Validator.getValidDirectoryPath(String, String, File, boolean) before version 2.3.0.0 may treat the input string as a child of the specified parent directory, potentially bypassing control-flow...
CVE-2021-4197
CVE-2021-4197 is a Linux kernel vulnerability in the cgroup process migration permission checks. A local attacker could escalate privileges due to incorrect permission validation for cgroup-associated processes (affecting both cgroup v1 and v2). The issue is described across multiple sources as a...
CVE-2026-46242
Summary (CVE-2026-46242) : The Linux kernel contains a fix for a UAF in eventpoll related to ep_remove. The bug arose when ep_remove_file() cleared file->f_ep under file->f_lock but continued using @file inside the critical section, allowing a concurrent path to reach freed memory via f_op-...
CVE-2022-41128
CVE-2022-41128 is a Windows Scripting Languages Remote Code Execution vulnerability in the JScript9 scripting language. Reports consistently describe a network-exploitable RCE where visiting a malicious site can trigger memory corruption and arbitrary code execution on affected Windows systems. E...
CVE-2010-4816
CVE-2010-4816 affects FreeBSD 8.0, 6.3, 4.9 and OpenBSD 4.6. The issue is a null pointer dereference in ftpd/popen.c that may enable remote denial of service of the ftpd service. The sources indicate a network-accessible trigger with availability impact, but do not provide exploitation details or...
CVE-2020-13956
CVE-2020-13956 affects Apache HttpClient prior to 4.5.13 and 5.0.3. A malformed authority component in request URIs, when passed as a java.net.URI, can cause the client to misinterpret the target host and execute the request against an unintended host. This represents a misrouting vulnerability i...
CVE-2016-3351
CVE-2016-3351 is a information-disclosure vulnerability affecting Microsoft Internet Explorer (IE) 9–11 and Microsoft Edge. The issue arises from improper handling of objects in memory by affected scripting engines, which could allow a remote attacker to detect or obtain sensitive files on the us...
CVE-2015-6175
CVE-2015-6175 is a Windows kernel local privilege escalation vulnerability. The initial description identifies a memory-elevation flaw in the Windows kernel that allows a crafted application running with local access to gain elevated privileges. Connected documents corroborate that this family in...
CVE-2015-4620
Vulnerability CVE-2015-4620 affects ISC BIND when configured as a DNSSEC-validating recursive resolver. name.c in BIND 9.7.x–9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2 can crash the server (assertion failure and daemon exit) after crafting zone data and issuing a query for a name in that z...
CVE-2021-30005
CVE-2021-30005 affects JetBrains PyCharm prior to 2020.3.4. The issue stems from PyCharm's initial project handling where, on first open, PyCharm would auto-activate a virtual environment found in the project, enabling an attacker to place a malicious venv in a VCS repository. A PoC demonstrates ...
CVE-2019-13638
CVE-2019-13638 affects GNU patch up to version 2.7.6. It enables OS shell command injection when processing a crafted patch file containing an ed-style diff payload with shell metacharacters; the ed editor need not be present on the target system. Multiple connected advisories confirm vulnerable ...
CVE-2016-3298
CVE-2016-3298 affects Microsoft Internet Explorer 9–11 and the Internet Messaging API on Windows (Vista/7/Server 2008 R2 family). The root cause is improper handling of objects in memory, enabling a crafted web site to disclose whether arbitrary files exist on disk (information disclosure). The v...
CVE-2022-22817
CVE-2022-22817 affects Pillow’s PIL.ImageMath.eval before 9.0.0, enabling evaluation of arbitrary expressions (including code execution) via the expression parameter; a workaround/change was introduced in Pillow 9.0.0 to restrict builtins. Upgrading to 9.0.0+ (per Pillow release notes) is the adv...
CVE-2021-21702
In PHP, the SOAP extension is vulnerable to a null-pointer dereference when a SOAP server returns malformed XML, potentially crashing the interpreter. Affected versions are PHP 7.3.x < 7.3.27, 7.4.x < 7.4.15, and 8.0.x
CVE-2026-23944
CVE-2026-23944 affects Arcane prior to v1.13.2. The vulnerability exists in the environment proxy middleware which handles /api/environments/{id}/… requests for remote environments before authentication is enforced. If the environment ID is not local, the middleware proxies the request and attach...
CVE-2022-21141
Airspan Networks/Mimosa CVE-2022-21141 describes improper authorization on multiple API functions in MMP, PTP C-series, PTMP C-series and A5x, allowing remote code execution, DoS, and information disclosure. Affected versions: MMP < 1.0.3; PTP C-series < 2.8.6.1; PTMP C-series/A5x
CVE-2011-3416
CVE-2011-3416 affects Microsoft .NET Framework's ASP.NET Forms Authentication, allowing remote authenticated users to obtain access to arbitrary user accounts via a crafted username. Affected: .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0. The issue is addressed by MS11-100; vulnerable...
CVE-2024-21626
CVE-2024-21626 affects runc prior to 1.1.12, with a file descriptor leak enabling container escapes from containerized processes (e.g., runc exec/run) and potential host filesystem access. The CVE description specifies attacks that could overwrite host binaries and escape to the host filesystem. ...
CVE-2023-34462
CVE-2023-34462 affects Netty SniHandler: during TLS handshake, it can allocate up to 16 MB of heap per channel (ByteBuf from ClientHello) if no idle timeout is set, enabling a crafted ClientHello to trigger memory growth and DoS. The issue is fixed in Netty 4.1.94.Final. Remediation: upgrade Nett...
CVE-2020-7064
CVE-2020-7064 is a PHP EXIF parsing vulnerability: when exif_read_data() processes EXIF data, malicious input may cause PHP to read one byte of uninitialized memory, enabling information disclosure or a crash. Affected are PHP 7.2.x below 7.2.9, 7.3.x below 7.3.16, and 7.4.x below 7.4.4. The issu...
CVE-2019-18196
Summary (CVE-2019-18196): A DLL sideloading vulnerability in the Windows Service component of TeamViewer allows potential code execution via a service restart when a malicious DLL is placed in the TeamViewer directory. Affected TeamViewer versions and fixes include: up to 11.0.133222 (fixed in 11...
CVE-2007-3126
Gimp before 2.8.22 is vulnerable to a denial-of-service via ICO files with an ICO InfoHeader Height of zero. The issue is a context-dependent crash and is documented in multiple advisories (e.g., Mageia openSUSE/SUSE updates) referencing CVE-2007-3126. A patch was released with GIMP 2.8.22 to fix...
CVE-2024-31497
PuTTY versions 0.68–0.80 (before 0.81) are vulnerable to a biased ECDSA nonce issue that can enable an attacker to recover a user’s NIST P-521 private key after observing signatures. The CVE is discussed in multiple advisories and vendor notices (Debian LTS advisory DLA-3839-1, Fedora package upd...
CVE-2022-38023
CVE-2022-38023 (NetLogon RC4-HMAC vulnerability) affects Samba and related packages (samba, samba-client, libsmbclient, libwbclient, etc.). Technical detail: the issue stems from allowing RC4/HMAC-MD5 in the NetLogon Secure Channel, weakening authentication between clients and servers. Affected p...
CVE-2022-24526
CVE-2022-24526 is a Visual Studio Code vulnerability described as Spoofing. Connected sources confirm a UI spoofing flaw in VS Code, with exploitation not detailed in the initial entry but reflected in multiple accompanying advisories. The vulnerability is tied to VS Code and has remediation refe...
CVE-2014-0546
Adobe Reader and Acrobat for Windows are affected by CVE-2014-0546 due to a sandbox bypass that enables attackers to execute native code in a privileged context via unspecified vectors. Affected products include Adobe Reader 10.x up to 10.1.11 and Acrobat 10.x up to 10.1.11 and 11.x up to 11.0.08...
CVE-2021-20277
CVE-2021-20277 affects Samba’s libldb. The flaw: multiple leading spaces in an LDAP attribute trigger an out-of-bounds write, crashing the LDAP server process and impacting availability. Connected advisories show affected packages and that a remediation exists via updated libldb versions (e.g., v...
CVE-2014-2817
CVE-2014-2817 summary (normal mode) : Affects Microsoft Internet Explorer 6–11, where a crafted web site can escalate privileges to the attacker. Root cause is an elevation of privilege vulnerability in IE; exploitation vector is remote and via a crafted page. Public exploits exist for this vulne...