CVE-2019-13636

CVE-2019-13636 affects GNU patch; the vulnerability arises from mishandling of following symlinks in inp.c and util.c in certain cases beyond input files. Public references describe potential for arbitrary file access/overwrite and, per Debian, shell command injection or escape from the working d...

CVE-2019-8457

CVE-2019-8457 affects SQLite3 prior to 3.28.0, with versions 3.6.0 through 3.27.2 vulnerable to a heap-out-of-bounds read in the rtreenode() function when processing invalid rtree tables. Reported impact includes high to critical severity (CVSSv3.1: 9.8, Network attack, no user interaction). The ...

CVE-2022-27507

CVE-2022-27507 affects Citrix ADC and Citrix Gateway. Affected conditions require DTLS enabled and either HDX Insight for EDT traffic or SmartControl configured, leading to an authenticated denial-of-service. Vulnerable versions include Citrix ADC/Gateway 12.1 prior to 12.1-64.17, 13.0 prior to 1...

CVE-2021-31535

CVE-2021-31535 affects libX11 (and related X.Org X components) where LookupCol.c handling of XLookupColor lacks proper length checks. An attacker can send color-name requests longer than protocol/packet limits, causing the server to parse extra X protocol requests and potentially execute arbitrar...

CVE-2020-14323

Affects Samba Winbind in Samba; root cause is a null pointer/invalid lookupsids path leading to a crash and DoS. Affected versions are prior to 4.11.15, prior to 4.12.9, and prior to 4.13.1. Remediation is to upgrade to a fixed Samba release (e.g., 4.13.x line such as 4.13.3 per AlmaLinux advisor...

CVE-2024-2511

CVE-2024-2511 describes a denial-of-service risk in TLSv1.3 servers caused by non-default TLS configurations. Specifically, using the non-default SSL_OP_NO_TICKET option (unless early_data with default anti-replay is configured) can cause the TLS session cache to enter an incorrect state and grow...

CVE-2022-31081

CVE-2022-31081 affects the Perl HTTP::Daemon library. Versions prior to 6.15 are vulnerable due to improper handling of the Content-Length header, which could enable HTTP request smuggling and potentially allow privileged access to APIs or poisoning of intermediate caches. The issue is documented...

CVE-2020-13576

CVE-2020-13576 affects Genivia gSOAP 2.8.107, where the WS-Addressing plugin can be exploited by a crafted SOAP request to achieve remote code execution. Public documents confirm the root cause is in the WS-Addressing plugin, enabling code execution on a networked host. Debian LTS advisories show...

CVE-2020-8015

CVE-2020-8015 is a local privilege-escalation in Exim packaging affecting openSUSE Factory exim versions prior to 4.93.0.4-3.1. The issue allows escalation from the mail user to root via a UNIX symbolic link (Symlink) following vulnerability. Remediation is to upgrade to Exim 4.93.0.4 or newer; S...

CVE-2021-46912

The CVE-2021-46912 entry describes a Linux kernel vulnerability where tcp_allowed_congestion_control is global and writable, allowing cross-namespace leakage. A fix was applied to make tcp_allowed_congestion_control readonly in non-init netns, addressing the per-net IPv4 congestion control sysctl...

CVE-2022-0194

Netatalk (vulnerable component: ad_addcomment) is affected by CVE-2022-0194. The flaw stems from improper validation of user-supplied data length before copying into a fixed-size stack buffer, enabling an unauthenticated attacker to execute arbitrary code with root privileges on affected installa...

CVE-2022-29526

CVE-2022-29526 is a privilege-assignment flaw in Go’s Faccessat path (go1.17.10 and go1.18.2 fixes cited in initial description). The provided connected documents confirm this CVE affects multiple downstream packages (e.g., buildah, podman, cni, containernetworking-plugins, golang, sriov-network-...

CVE-2022-25856

The CVE-2022-25856 entry affects the Argo Events project: the GitArtifactReader.Read() implementation in the sensors/artifacts code path (git.go) allows directory traversal, enabling an attacker to read arbitrary files when a path contains a symbolic link or an implicit directory (e.g., using ../...

CVE-2021-34558

CVE-2021-34558 affects the Go crypto/tls implementation. In Go up to 1.16.5, the certificate public-key type is not properly validated for RSA-based key exchanges, allowing a TLS server to trigger a panic in the client. Several connected advisories link this to Go’s TLS handling and note remediat...

CVE-2020-12888

CVE-2020-12888 affects the Linux kernel VFIO PCI driver (through 5.6.13) and arises from improper handling of accesses to disabled MMIO space. A local attacker or a guest VM with VFIO access could trigger a denial of service or crash by exploiting writes/reads to disabled memory regions. Connecte...

CVE-2018-18809

TIBCO JasperReports Library and related JasperReports Server components are affected by a directory traversal vulnerability (CVE-2018-18809) in their default server implementations. The issue could allow web server users to access contents of the host system via specially crafted URL requests con...

CVE-2016-8101

The CVE-2016-8101 issue affects Intel SSD Toolbox updater subsystem and is present in versions prior to 3.3.7. A local attacker can gain privileges via unspecified vectors; the exact exploit path is not detailed in the provided documents. The trusted remediation is to upgrade to version 3.3.7 or ...

CVE-2011-4969

CVE-2011-4969 : XSS in jQuery prior to 1.6.3 when using location.hash to select elements. A remote attacker could inject arbitrary script/HTML into a page. Affected: jQuery versions before 1.6.3. Remediation: upgrade to 1.6.3 or later (patches/fixes cited by IBM and vendor advisories). Public ref...

CVE-2022-41724

CVE-2022-41724 describes a vulnerability where large TLS handshake records may cause panics in crypto/tls implementations. Affected are Go TLS clients (including TLS1.3 and TLS1.2 with session resumption) and TLS1.3 servers that request client certificates. Technical cause is panics when construc...

CVE-2022-31027

CVE-2022-31027 affects the OAuthenticator/CILogonOAuthenticator used by JupyterHub. The root cause is that allowed_idps is validated only by email domain, not by IdP (provider) identity, allowing login via an alternate IdP with a @domained email (e.g., berkeley.edu) to bypass intended restriction...

CVE-2022-29130

Technical details about CVE-2022-29130 are not provided in the connected documents. Publicly available information in the initial entry is limited to high‑level descriptors; no product/version/impact/fix specifics are included here. Monitor for official updates.

CVE-2021-29425

CVE-2021-29425 affects Apache Commons IO up to version 2.6, specifically FileNameUtils.normalize. With inputs such as "//../foo" or "\..\foo", normalization can yield a value that does not escape to higher directories, potentially enabling access to the parent directory if the resulting path is u...

CVE-2019-11768

phpMyAdmin prior to 4.9.0.1 is affected by an SQL injection via the Designer feature triggered by a specially crafted database name. The issue is fixed in 4.9.0.1 (and later per advisories). Impact per sources includes potential high-severity consequences; upgrade to 4.9.0.1 or newer to remediate.

CVE-2012-2705

The CVE-2012-2705 entry concerns the Drupal Smart Breadcrumb module (6.x-1.x) prior to 6.x-1.3. The root cause is that filter_titles() fails to properly filter user-supplied titles to plain-text, enabling cross-site scripting (XSS) by remote authenticated users who have create or edit node permis...

CVE-2025-46565

CVE-2025-46565 (Vite) affects Vite < 6.3.4, < 6.2.7, < 6.1.6, < 5.4.19, and

CVE-2024-3833

CVE-2024-3833 is a Chrome/Chromium WebAssembly object-corruption vulnerability (via a crafted HTML page) tracked as high-severity, with reported fixes in Chromium 124.0.6367.60 and later (ChromeOS notes cite 124.0.6367.95; Debian security advisories list 124.0.6367.60 as the fixed version). Affec...

CVE-2023-22068

CVE-2023-22068 affects Oracle MySQL Server (InnoDB). Affected: MySQL 8.0.34 and earlier, and 8.1.0. An attacker with network access via multiple protocols and high privileges can cause the server to hang or crash (DoS). No explicit exploitation details are provided beyond this claim. Remediation:...

CVE-2022-21607

CVE-2022-21607 is a vulnerability in Oracle MySQL Server, specifically in the Server: Optimizer component. Affected are MySQL Server versions up to and including 8.0.28 (and prior). The flaw is exploitable by a high-privilege attacker who can reach the server over the network via multiple protoco...

CVE-2021-29650

CVE-2021-29650 affects the Linux kernel prior to 5.11.11. The netfilter subsystem (net/netfilter/x_tables.c and include/linux/netfilter/x_tables.h) may omit a full memory barrier when a new table value is assigned, enabling a local attacker to trigger a DoS/panic in netfilter. The issue is docume...

CVE-2021-25764

PhpStorm (JetBrains) before 2020.3 is affected: the issue lets source code be written into debug logs (“Source code could be added to debug logs”). The vulnerability affects PhpStorm’s logging path and can lead to information disclosure via logs. The issue is tracked as CVE-2021-25764. Remediatio...

CVE-2020-12641

Roundcube Webmail is affected by CVE-2020-12641 due to an injection vulnerability in rcube_image.php. The issue allows an attacker to execute arbitrary code by supplying shell metacharacters in configuration settings for im_convert_path or im_identify_path. The documented impact is remote code ex...

CVE-2018-20677

Bootstrap before 3.4.0 is vulnerable to cross-site scripting via the affix configuration target property due to improper handling of input in that attribute. The issue enables XSS in the affected component, and the condition is described as existing in Bootstrap 3.x prior to 3.4.0. Public referen...

CVE-2023-4428

CVE-2023-4428 affects Chromium-based browsers (Chrome/Chromium) and relates to an out-of-bounds memory access in CSS that could allow a remote attacker to read memory via a crafted HTML page. The issue is classified with high severity and a network attack vector, with user interaction required. T...

CVE-2010-1256

CVE-2010-1256 is an IIS memory-corruption vulnerability (IIS 6.0/7.0/7.5) tied to Extended Protection for Authentication. A remote attacker could execute arbitrary code by abusing how authentication information is parsed, when Extended Protection is enabled (KB973917). Microsoft MS10-040 fixes th...

CVE-2021-46910

CVE-2021-46910 relates to the Linux kernel’s kmap_local(): when CONFIG_DEBUG_KMAP_LOCAL=y, per-CPU fixmap slots are doubled, causing the fixmap region to grow downwards and potentially collide with the virtual DT mapping. The documented impact is a local exploit path leading to kernel instability...

CVE-2022-28162

CVE-2022-28162 affects Brocade SANnav before version 2.2.0. The root cause is logging the REST API authentication token in plain text, potentially exposing credentials. Affected products are Brocade SANnav deployments prior to 2.2.0. Remediation is to upgrade to SANnav 2.2.0 or later (per the Bro...

CVE-2023-22103

CVE-2023-22103 affects Oracle MySQL Server (Server: Optimizer). Affected: MySQL 8.0.34 and earlier, and 8.1.0. Attack via network with high privileges can cause a hang or frequent crash (DoS) of MySQL Server. CVSS v3.1 base score 4.9 (Availability). Remediation: upgrade to a fixed package/version...

CVE-2024-57432

The CVE-2024-57432 entry concerns macrozheng mall-tiny 1.0.1 with insecure permissions due to hardcoded JWT signing keys. The JWT contains user information and is used for privilege management, enabling forging of arbitrary users’ tokens and authentication bypass. Concrete details across connecte...

CVE-2020-15801

CVE-2020-15801 (Siemens SIMATIC S7-1500) : The Tenable plugin for Tenable OT documents a vulnerability affecting the SIMATIC S7-1500 family (CPU 1518-4 PN/DP MFP, SIPLUS variants) with all versions prior to V3.1.0. The issue stems from Python 3.8.4 behavior: sys.path restrictions in python38._pth...

CVE-2020-13934

CVE-2020-13934 affects multiple Apache Tomcat releases (8.5.1–8.5.56, 9.0.x, 10.0.x up to M6) where an h2c direct connection didn’t release the HTTP/1.1 processor after upgrading to HTTP/2, potentially causing OutOfMemoryError and denial of service. Public advisories across vendors and distributi...

CVE-2017-11103

CVE-2017-11103 affects Heimdal (Kerberos); vulnerability arises from improper handling of the KDC-REP service name in krb5_extract_ticket, enabling remote service impersonation when the unencrypted service name is used instead of the encrypted enc_part. Apple’s security content (HT208112/HT208221...

CVE-2020-24588

The CVE-2020-24588 entry relates to the 802.11 Wi‑Fi fragmentation/ A‑MSDU handling issue where the plaintext QoS header flag isn’t authenticated, enabling an attacker to inject packets by sending non‑SSP A‑MSDU frames (FragAttacks). Connected Astra Linux advisories describe this as a variant of ...

CVE-2019-15505

CVE-2019-15505 affects the technisat-usb2 media driver in Linux kernels up to 5.2.9. The issue arises from improper validation of incoming IR packets, leading to a heap buffer over-read. An attacker capable of adding USB devices (potentially via remote USB technologies like usbip/usbredir) could ...

CVE-2017-0781

CVE-2017-0781 is a remote code execution vulnerability in the Android Bluetooth stack (BNEP) that allows crafting packets to overflow a heap buffer and execute code. Connected PoC/Exploit references (BlueBorne) describe Android RCE via the BNEP service and related Bluetooth flaws across Android v...

CVE-2014-0196

CVE-2014-0196 affects the Linux kernel (through 3.14.3) specifically the n_tty_write function in drivers/tty/n_tty.c. The flaw permits a local user to trigger a race condition between read and write operations with long strings in the LECHO & !OPOST case, enabling denial of service (memory corrup...

CVE-2024-10318

Summary of CVE-2024-10318: A session-fixation vulnerability in the NGINX OpenID Connect reference implementation arises from nonce validation being skipped at login. This allows an attacker to coerce a victim’s session to an attacker-controlled account, enabling potential misuse of the victim’s s...

CVE-2022-36227

CVE-2022-36227 affects libarchive (before 3.6.2). The bug is a NULL pointer dereference caused by not checking the result of calloc, which can return NULL and lead to dereference. Some sources acknowledge that this could in rare circumstances permit arbitrary code execution if NULL is treated as ...

CVE-2022-21641

Summary (from provided sources): CVE-2022-21641 affects Oracle MySQL Server, specifically the Server: Optimizer component. Affected versions are 8.0.29 and earlier. The vulnerability is exploitable by a high-privilege attacker with network access via multiple protocols and can lead to a hang or a...

CVE-2017-20005

CVE-2017-20005 affects NGINX before 1.13.6. It is a buffer overflow in the autoindex module triggered by modification dates with years exceeding four digits (e.g., 1969 or far-future dates), caused by integer overflow. The CVSSv3.1 vector and score indicate CRITICAL severity. Remediation per sour...

CVE-2020-7595

CVE-2020-7595 affects libxml2, specifically the xmlStringLenDecodeEntities function in parser.c of version 2.9.10, which can enter an infinite loop in certain end-of-file situations. Several connected advisories (e.g., ASA-202011-15) corroborate the issue and describe the impact as potential deni...