CVE-2011-3268

Technical details about CVE-2011-3268 are not provided in the connected documents; only the initial description is available. Monitor for updates.

CVE-2022-29155

OpenLDAP CVE-2022-29155 affects OpenLDAP 2.x prior to 2.5.12 and 2.6.x prior to 2.6.2. The vulnerability resides in the experimental back-sql backend used by slapd, where an LDAP search may process a SQL statement without proper escaping in the search filter. The underlying issue is SQL injection...

CVE-2020-14383

CVE-2020-14383 affects Samba's DNS server. An authenticated user can trigger a crash of the DNS-related RPC server due to uninitialized variables, leaving the Samba DNS service operational but disrupting many RPC services and causing partial availability impact. Remediation is via upgrading Samba...

CVE-2019-12519

CVE-2019-12519 in Squid (up to 4.7) originates from ESI handling: ESIExpression::Evaluate uses a fixed stack buffer and does not check for overflow when adding a new member, causing a stack/heap overflow under certain expressions and potentially impacting confidentiality, integrity, and availabil...

CVE-2019-14835

The CVE-2019-14835 entry describes a buffer overflow in Linux kernel vhost functionality (virtqueue buffers translated to IOVs) during VM live migration. A privileged guest user could pass descriptors with invalid length while migration is underway, potentially causing a host privilege escalation...

CVE-2025-68613

CVE-2025-68613 (n8n) : Affects n8n open source workflow automation prior to patched versions 1.120.4, 1.121.1, 1.122.0. Root cause is insufficient isolation in the workflow expression evaluation system, allowing authenticated users to cause the n8n process to execute arbitrary code in the runtime...

CVE-2023-4091

CVE-2023-4091 affects Samba, where the acl_xattr VFS module can allow an SMB client to truncate files to zero bytes even when opened with read-only access. This occurs when acl_xattr:ignore system acls = yes and the client uses an OVERWRITE create disposition, bypassing kernel permissions checks....

CVE-2023-3223

CVE-2023-3223 relates to Undertow: Servlets annotated with @MultipartConfig may cause an OutOfMemoryError from large multipart content, enabling remote DoS. A bypass may occur if fileSizeThreshold limits are configured but the file name in the request is set to null. The Nessus plugin notes an un...

CVE-2022-1802

CVE-2022-1802 involves prototype pollution in JavaScript arrays, enabling attacker-controlled code execution in a privileged context when methods of an Array object can be corrupted. Affected software includes Mozilla Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0...

CVE-2021-33037

CVE-2021-33037 affects Apache Tomcat: versions 10.0.0-M1–10.0.6, 9.0.0.M1–9.0.46, and 8.5.0–8.5.66 may mishandle the HTTP transfer-encoding header with reverse proxies, enabling request smuggling. Root cause: improper header handling allowing spoofed content encoding sequencing. Impact stated in ...

CVE-2020-28196

CVE-2020-28196 affects MIT Kerberos 5 (krb5) prior to 1.17.2 and 1.18.x prior to 1.18.3. The vulnerability stems from unbounded recursion in the ASN.1 BER decoder (lib/krb5/asn.1/asn1_encode.c) due to no recursion limit for indefinite lengths. This can lead to denial of service due to resource ex...

CVE-2019-11932

CVE-2019-11932 is a double-free vulnerability in the android-gif-drawable library (DDGifSlurp in decoding.c) affecting versions before 1.2.18, used by WhatsApp for Android prior to 2.19.244. When parsing a specially crafted GIF image, an attacker can trigger remote code execution or cause denial ...

CVE-2017-3145

CVE-2017-3145 affects BIND: the resolver incorrectly sequenced cleanup operations on upstream recursion fetch contexts, causing a use-after-free that can trigger an assertion failure and crash named. Affected versions include BIND 9.0.0 through 9.8.x, 9.9.0–9.9.11, 9.10.0–9.10.6, 9.11.0–9.11.2, 9...

CVE-2024-12746

Summary: CVE-2024-12746 concerns the Amazon Redshift ODBC Driver (v2.1.5.0) for Windows/Linux, where a SQL injection via the SQLTables or SQLColumns Metadata APIs can let a user escalate privileges. The issue is confirmed in multiple sources attached to the CVE, with recommended mitigation: upgra...

CVE-2023-42754

CVE-2023-42754 is a vulnerability in the Linux kernel IPv4 stack: a NULL pointer dereference where skb may not be bound to a device before __ip_options_compile if the skb is re-routed by ipvs. The impact is a local crash under CAP_NET_ADMIN. Public details in connected advisories reaffirm the iss...

CVE-2022-32744

CVE-2022-32744 concerns Samba’s Kerberos KDC, where forged kpasswd requests can be encrypted with any key, allowing password changes for other users and potentially full domain takeover. Affected software is Samba (KDC/Auth components). The root cause is improper validation of kpasswd requests, e...

CVE-2021-22543

CVE-2021-22543 is described in connected advisories as a local privilege-escalation through KVM and improper handling of VM_IO|VM_PFNMAP VMAs, which can bypass RO checks and allow reading/writing guest memory by a privileged VM operator. Technical details across sources indicate the vulnerability...

CVE-2020-25649

The CVE-2020-25649 entry concerns a flaw in FasterXML Jackson Databind where entity expansion was not properly secured, enabling XML External Entity (XXE) attacks. This is a data-integrity risk. Connected advisories consistently associate the issue with Jackson Databind and XXE, and several sourc...

CVE-2019-13132

CVE-2019-13132 concerns ZeroMQ libzmq: a remote, unauthenticated client connecting to a libzmq app with a CURVE-enabled listening socket can trigger a stack/buffer overflow in the library, for libzmq versions up to just before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2. Public servers runn...

CVE-2025-67896

Exim vulnerability CVE-2025-67896 affects Exim before 4.99.1 with certain non-default rate-limit configurations, enabling a remote heap-based buffer overflow due to unvalidated casting of database records to internal structures. Fedora advisories indicate fixes in exim-4.99.1-1 (FC42/FC43). Impac...

CVE-2025-62168

Squid (proxy/cache) prior to version 7.2 is affected by information disclosure due to failure to redact HTTP authentication credentials in error handling. The vulnerability can allow a remote, unauthenticated attacker to learn credentials or tokens used by a trusted client or internal web applica...

CVE-2024-25943

Dell iDRAC9 is affected by CVE-2024-25943. Affected versions are 14th Generation prior to 7.00.00.172 and 15th/16th Generations prior to 7.10.50.00. The issue is a session hijacking vulnerability in IPMI that could allow a remote attacker to execute arbitrary code in the vulnerable application. R...

CVE-2021-46931

CVE-2021-46931 involves the Linux kernel mlx5e path (net/mlx5e, mlx5_core) where a TX-timeout-recovery flow calls mlx5e_tx_reporter_dump_sq() with a void* that is actually a mlx5e_tx_timeout_ctx*. The mismatch corrupts stack state and can trigger a kernel panic/stack overflow. The fix adds a wrap...

CVE-2022-29914

CVE-2022-29914 describes a memory-safety/logic issue in Firefox/Thunderbird where reusing existing popups could cover the fullscreen notification UI, enabling browser spoofing attacks. Affected products include Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox

CVE-2022-21638

CVE-2022-21638 affects Oracle MySQL Server (component: Server: Optimizer). Affected: MySQL Server 8.0.29 and earlier. Attack surface: network-accessible via multiple protocols; requires high privileges; can cause a hang or frequent crash (denial of service). Several connected advisories confirm a...

CVE-2022-26668

CVE-2022-26668 is an ASUS Control Center API broken access-control vulnerability. Connected docs indicate affected product ASUS Control Center, with vulnerable version referenced by CNNVD as v1.4.2.5. The flaw allows an unauthenticated remote attacker to call privileged API functions, enabling pa...

CVE-2020-27840

CVE-2020-27840 affects Samba. The flaw is a heap corruption vulnerability caused by spaces in a domain-name DN string, which can cause an out-of-bounds write and crash the process. Impact is primarily availability. Public details show Samba package variants (e.g., Samba 4.12.5-7) and notes that u...

CVE-2019-3855

CVE-2019-3855 is a libssh2 integer overflow in the transport read path that may cause an out-of-bounds write when processing server packets. The issue appears in libssh2 prior to 1.8.1 and could enable code exposure or other impact if a user connects to a malicious SSH server. Connected advisorie...

CVE-2017-5645

CVE-2017-5645 affects Apache Log4j 2.x prior to 2.8.2. The vulnerability arises when using a TCP/UDP socket server to receive serialized log events from another application; a crafted binary payload can be deserialized to execute arbitrary code. The documented impact is remote code execution via ...

CVE-2016-8740

CVE-2016-8740 affects Apache HTTP Server mod_http2 when Protocols includes h2/h2c. A memory-exhaustion DoS arises from improper restriction of request-header length in crafted CONTINUATION frames in versions 2.4.17–2.4.23. Connected sources confirm the root cause is header-length handling without...

CVE-2013-3163

Microsoft Internet Explorer 8–10 contains a memory corruption vulnerability (CVE-2013-3163) that allows remote code execution or a denial of service when a user visits a crafted web site. Affected component: IE’s memory handling in versions 8–10; root cause described as memory corruption via craf...

CVE-2026-35388

OpenSSH (before 10.3) is affected by a vulnerability in proxy-mode multiplexing where the system omits connection multiplexing confirmation for multiplexing sessions. The issue is tied to OpenSSH’s proxy-mode multiplexing behavior and is described as a flaw in the handling of multiplexing confirm...

CVE-2025-55752

CVE-2025-55752 describes a Relative Path Traversal in Apache Tomcat introduced by a fix for bug 60013, allowing manipulation of the request URI to bypass protections for /WEB-INF/ and /META-INF/ and, if PUTs are enabled, potentially upload of malicious files leading to remote code execution. Affe...

CVE-2025-22150

Undici (HTTP/1.1 client) is affected by CVE-2025-22150 in versions prior to 5.28.5, 6.21.1, and 7.2.3 due to using Math.random() to generate multipart/form-data boundaries. This can enable an attacker-controlled endpoint to tamper with requests if specific conditions are met, potentially affectin...

CVE-2022-41034

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2022-31313

CVE-2022-31313 affects the PyPI package api-res-py (version 0.1). The vulnerability is a code execution backdoor in the request package, enabling an attacker to execute arbitrary code. Multiple connected sources (Red Hat, Veracode, OSV, GHSA) corroborate a malicious backdoor in the api-res-py ent...

CVE-2022-29266

Apache APISIX prior to 3.13.1 is affected by an information-disclosure issue in the jwt-auth plugin. The error message returned by the dependency lua-resty-jwt can leak the user’s secret key, enabling leakage of sensitive credentials. Affected product: Apache APISIX (jwt-auth plugin); vulnerable ...

CVE-2024-3393

CVE-2024-3393 affects Palo Alto Networks PAN-OS DNS Security: a vulnerability in parsing/logging malicious DNS packets allows an unauthenticated attacker to reboot the firewall via a crafted packet, with repeated attempts forcing maintenance mode. Connected sources indicate active exploitation an...

CVE-2024-53104

CVE-2024-53104 affects the Linux kernel USB Video Class (UVC) driver, specifically the uvc_parse_format logic which should skip frames of type UVC_VS_UNDEFINED. The fix prevents an out-of-bounds write in uvc_parse_streaming caused by mis-sized frame buffers, addressing an out-of-bounds write vuln...

CVE-2024-32002

CVE-2024-32002 affects Git when cloning repositories with submodules, where a bug can cause files to be written into a .git directory instead of the submodule worktree. This can lead to a hook being executed during an ongoing clone, potentially enabling remote code execution without user inspecti...

CVE-2022-30209

Technical details (affected products, exploit vector, root cause, and remediation) are not provided in the supplied documents. Monitor for updates from official sources.

CVE-2021-22569

CVE-2021-22569 concerns protobuf-java: an issue allowing interleaving of UnknownFieldSet fields that can cause the parser to linger due to many short-lived objects, potentially enabling DoS-like pauses. Connected sources show this vulnerability in multiple ecosystems (e.g., Debian protobuf packag...

CVE-2019-11036

CVE-2019-11036 involves a heap-based buffer over-read in the PHP EXIF extension when processing EXIF data, potentially allowing information disclosure or a crash. The connected advisories confirm this issue and related EXIF problems (CVE-2019-11034, CVE-2019-11035, CVE-2019-11036, CVE-2019-11038–...

CVE-2023-23415

CVE-2023-23415 is described via connected sources as an ICMP-based Remote Code Execution affecting Windows. The referenced material states that exploitation could involve sending a malicious fragmented ICMP packet to a vulnerable host bound to a raw socket, potentially enabling arbitrary code exe...

CVE-2026-25243

Redis server vulnerability CVE-2026-25243: In Redis up to version 8.6.3, the RESTORE command fails to properly validate serialized values, allowing an authenticated attacker with RESTORE access to supply a crafted payload that may trigger invalid memory access and potentially lead to remote code ...

CVE-2025-10585

CVE-2025-10585 is a Type Confusion in Google Chrome’s V8 engine that can enable heap corruption via specially crafted HTML pages. Multiple connected sources confirm the vulnerability affects Chrome/Chromium (V8), with remote, no-user-interaction exploitation described in NVD/Chromium advisories a...

CVE-2024-57077

CVE-2024-57077 affects utils-extend (version 1.0.8) with a Prototype Pollution flaw in the lib.extend entry point. The vulnerability allows an attacker to inject properties into Object.prototype, which can cause a denial of service (DoS). Public details include a PoC demonstrating pollution; sour...

CVE-2023-32412

CVE-2023-32412 involves a use-after-free in a component likely within Apple platform software. Affected: watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, macOS Big Sur 11.7.7, macOS Monterey 12.6.6, iOS 15.7.6/iPadOS 15.7.6 and iOS 16.5/iPadOS 16.5. Root cause: use-after-free memory issue addressed by...

CVE-2022-26384

Summary: CVE-2022-26384 is a sandbox bypass in Firefox/Thunderbird caused by allowing popups in an iframe sandbox without allow-scripts, enabling crafted links to execute JavaScript in violation of the sandbox. Connected advisories confirm affected products (Firefox < 98, Firefox ESR < 91.7...

CVE-2022-21605

CVE-2022-21605 concerns the Oracle MySQL Server, specifically the Server: Data Dictionary component. Affected are MySQL Server versions 8.0.28 and earlier . The vulnerability enables a high-privilege attacker with network access (via multiple protocols) to cause the server to hang or crash, resul...