CVE-2012-1182

The CVE-2012-1182 issue in Samba stems from the PIDL-based DCE/RPC code generator not validating array lengths during RPC handling, creating an out-of-bounds/heap-overflow condition that enables remote code execution. Affected branches include Samba 3.x before 3.4.16, 3.5.x before 3.5.14, and 3.6...

CVE-2024-37890

The CVE-2024-37890 entry concerns the ws WebSocket library for Node.js. In vulnerable releases, a request containing more headers than server.maxHeadersCount can crash a ws server. The issue has been fixed in [email protected] and backported to [email protected], [email protected], and [email protected]. Remediation/mitigation av...

CVE-2022-28737

CVE-2022-28737 is confirmed with concrete technical details in connected records. The issue is an out-of-bounds write in the shim loading path, caused by handling of the SizeOfRawData field in EFI sections via handle_image(), leading to memory corruption and potential arbitrary code execution. Af...

CVE-2022-38751

CVE-2022-38751 affects SnakeYAML (Java YAML parser). Issue: denial-of-service when parsing untrusted YAML, potentially via stack overflow. Public details in multiple advisories confirm affected packages and urge upgrade. Remediation per sources includes upgrading SnakeYAML to newer releases (e.g....

CVE-2022-2625

CVE-2022-2625 affects PostgreSQL and allows an attacker with permission to create non-temporary objects in a schema to trick an admin into creating/updating an affected extension and lure a victim to use a targeted object via CREATE OR REPLACE or CREATE IF NOT EXISTS, enabling arbitrary code exec...

CVE-2021-26271

CVE-2021-26271 affects CKEditor 4 before 4.16. An attacker could trigger a ReDoS-type DoS by persuading a victim to paste crafted text into the Styles input of dialogs (Advanced Tab in the Dialogs plugin). Affected versions are CKEditor 4.x prior to 4.16; remediation is to upgrade to 4.16 or newe...

CVE-2018-12130

CVE-2018-12130 : Microarchitectural Fill Buffer Data Sampling (MFBDS). Some Intel CPUs using speculative execution may leak information via fill buffers to a local attacker. Publicly referenced documents describe mitigations including microcode updates and OS/kernel mitigations (e.g., TSX/related...

CVE-2013-0424

CVE-2013-0424 is an unspecified vulnerability in the Java Runtime Environment (JRE) component affecting Oracle Java SE 7 up to Update 11, 6 up to Update 38, 5.0 up to Update 38, and 1.4.2_40 and earlier, plus OpenJDK 7. The issue relates to RMI and could allow remote attackers to affect integrity...

CVE-2025-58754

CVE-2025-58754 affects Axios (Node.js) where, in versions prior to 0.30.2 and 1.12.0, processing a data: URL causes the Node http adapter to decode the entire payload into memory, bypassing maxContentLength/maxBodyLength, and return a synthetic 200 response. This can lead to unbounded memory allo...

CVE-2025-24970

CVE-2025-24970 (Netty) affects Netty 4.1.91.Final through 4.1.118.Final. A crafted packet via SslHandler can fail validation, causing a native crash. A patch exists in 4.1.118.Final. Workarounds include disabling the native SSLEngine or applying code-level changes as noted by advisories. IBM bull...

CVE-2023-49103

The CVE-2023-49103 vulnerability affects ownCloud graphapi in versions 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The issue stems from a third‑party GetPhpInfo.php that returns a phpinfo() output, exposing the PHP environment and webserver variables (potentially including admin passwords, mail cr...

CVE-2023-34598

Gibbon v25.0.0 is affected by a Local File Inclusion (LFI) vulnerability that allows the server to include content from files within the installation folder in responses. Root cause: unsafely including local files via request handling. Impact: potential exposure of sensitive files; risk escalatio...

CVE-2023-29402

CVE-2023-29402 affects the golang package; the root cause is the go command generating unexpected code at build time when using cgo, occurring especially with untrusted modules whose directories contain newline characters in their names. The impact is outlined as potential unexpected behavior in ...

CVE-2022-29911

CVE-2022-29911 is an iframe sandbox bypass vulnerability described as an improper implementation of allow-top-navigation-by-user-activation that could permit script execution without allow-scripts. Affected products include Thunderbird (<91.9), Firefox ESR (<91.9), and Firefox (

CVE-2022-41223

The CVE-2022-41223 issue affects the Director database component of Mitel MiVoice Connect (up to 19.3 / 22.22.6100.0). An authenticated attacker can perform a code-injection attack via crafted data due to insufficient restrictions on the database data type. This vulnerability is tracked by CISA a...

CVE-2022-29081

CVE-2022-29081 affects Zoho ManageEngine products: Access Manager Plus (before 4302), Password Manager Pro (before 12007), and PAM360 (before 5401). The issue is an access-control bypass on certain REST API endpoints (SSOutAction, SSLAction, LicenseMgr, GetProductDetails, GetDashboard, FetchEvent...

CVE-2021-28165

The CVE-2021-28165 issue affects Eclipse Jetty versions 7.2.2–9.4.38, 10.0.0.alpha0–10.0.1, and 11.0.0.alpha0–11.0.1, where handling a large invalid TLS frame can cause CPU usage to reach 100%, leading to resource exhaustion. The underlying cause is described as abnormal processing after receivin...

CVE-2025-5283

CVE-2025-5283 is a use-after-free in libvpx used by Google Chrome prior to 137.0.7151.55, enabling potential heap corruption via a crafted HTML page. The connected advisories confirm affected libraries and advise updating libvpx to a fixed release across affected distributions (e.g., library upda...

CVE-2023-4155

CVE-2023-4155 describes a vulnerability in the Linux kernel’s KVM AMD SEV implementation. A KVM guest using SEV-ES or SEV-SNP with multiple vCPUs can trigger a double fetch race that causes the VMGEXIT handler to be invoked recursively. If the handler is called multiple times, this can lead to a ...

CVE-2022-29909

CVE-2022-29909 is a Firefox/Thunderbird vulnerability described as privilege escalation via deeply-nested cross-origin browsing contexts that could inherit top-level permissions. Affected products and versions from connected advisories: Thunderbird < 91.9 and Firefox (including ESR)

CVE-2022-24769

CVE-2022-24769 affects Moby (Docker Engine) before 20.10.14. The bug starts containers with non-empty inheritable Linux process capabilities, enabling programs with inheritable file capabilities to elevate to the container’s permitted set during execve, potentially impacting containers using Linu...

CVE-2020-8286

The CVE-2020-8286 issue affects curl/libcurl where OCSP responses were not verified correctly against the certificate, leaving room for fraudulent OCSP responses to appear valid and potentially bypass revocation checks. Reported range: curl versions 7.41.0 through 7.73.0. Impact phrasing in cited...

CVE-2019-8526

CVE-2019-8526 is a use-after-free vulnerability in macOS Mojave that could allow a locally authenticated attacker to gain elevated privileges. The issue was addressed with improved memory management and is fixed in macOS Mojave 10.14.4. The CVSS data (3.1) indicates HIGH impact on confidentiality...

CVE-2019-2805

CVE-2019-2805 affects the MySQL/MariaDB Server parser (and related Server components). Affected versions include MySQL/MariaDB 5.6.44 and earlier, 5.7.26 and earlier, and 8.0.16 and earlier. It is exploitable over the network and can cause the MySQL Server to hang or crash (DoS). Multiple connect...

CVE-2018-1336

CVE-2018-1336 applies to Apache Tomcat . It is caused by an overflow in the UTF-8 decoder when handling supplementary characters, which can trigger an infinite loop and cause a Denial of Service. Affected software ranges include Tomcat 9.0.0.M9–9.0.7, 8.5.0–8.5.30, 8.0.0.RC1–8.0.51, and 7.0.28–7....

CVE-2015-5383

Summary: CVE-2015-5383 affects Roundcube Webmail 1.1.x before 1.1.2, where a remote attacker can read files from the config, temp, or logs directories to obtain sensitive information. The root cause is an information-disclosure path that allows unintended access to local files. The vulnerability ...

CVE-2008-2072

CVE-2008-2072 describes a Cross-site scripting (XSS) vulnerability in index.php of Virtual Design Studio vlbook 1.21, allowing remote attackers to inject arbitrary web script or HTML via the l parameter. The entry notes this is a different vector from CVE-2006-3260, and the affected component is ...

CVE-2025-5064

CVE-2025-5064 relates to an inappropriate implementation in Chrome's Background Fetch API that could leak cross-origin data via a crafted HTML page. Affected product: Google Chrome (Chromium base). The issue is mitigated by upgrading to Chrome 137.0.7151.55 or later (Chromium fix referenced by Ch...

CVE-2024-1597

CVE-2024-1597 affects the PostgreSQL JDBC Driver (libpgjava) used with pgjdbc. The vulnerability exists when PreferQueryMode=SIMPLE is enabled (not the default); an attacker can inject SQL to alter queries. Affected versions include before 42.7.2, and older 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42....

CVE-2019-9515

CVE-2019-9515 concerns an HTTP/2 settings flood that can cause memory/CPU exhaustion. Arista’s security advisory (Security Advisory 0043) states the vulnerability is in Go’s gRPC HTTP/2 usage and can affect TerminAttr, OpenConfig, CVP, and certain Wi‑Fi OpenConfig-enabled components when enabled....

CVE-2019-6974

CVE-2019-6974 affects the Linux kernel KVM subsystem: a race in kvm_ioctl_create_device() mishandles reference counting, enabling a local user with access to /dev/kvm to cause a use-after-free, potentially crashing the guest or escalating privileges. The issue is fixed in kernel 4.20.8 and relate...

CVE-2015-4599

CVE-2015-4599 affects PHP’s SoapFault::__toString in ext/soap/soap.c. The issue arises from a type confusion when processing unexpected data types, enabling remote attackers to obtain sensitive information, trigger a denial of service (application crash), or possibly execute arbitrary code. Affec...

CVE-2002-0651

CVE-2002-0651 relates to a buffer overflow in DNS resolver code used by libc, glibc, and libbind (originating from ISC BIND). Connected advisories describe that versions of ISC BIND upstream prior to 9.2.1 were vulnerable to a resolver buffer overflow which could be triggered by crafted DNS respo...

CVE-2024-57719

Technical details about CVE-2024-57719 (affected components, root cause, and patch specifics) are not provided in the connected documents; Fedora advisories reference lunasvg/imhex and list the CVE but do not disclose the technical details.

CVE-2023-36742

Microsoft Visual Studio Code is affected by CVE-2023-36742 through vulnerable pre-1.82.1 builds. Connected documents describe a remote code execution scenario in VS Code where a user must open a malicious project; a crafted dependencies entry in package.json causes npm to execute scripts locally,...

CVE-2023-1972

CVE-2023-1972 is a memory corruption issue in GNU Binutils. The initial description confirms a potential heap-based buffer overflow in _bfd_elf_slurp_version_tables() within bfd/elf.c, which may lead to loss of availability. Connected documents specify affected package family as binutils and note...

CVE-2020-25097

CVE-2020-25097 affects Squid proxy (versions 4.13 and 5.x up to 5.0.4) due to improper input validation while parsing request URIs, enabling HTTP request smuggling by a trusted client and access to services otherwise restricted. The issue is activated for certain uri_whitespace configurations. Pu...

CVE-2020-15257

The CVE describes a privilege-escalation issue in containerd where access controls on the shim API socket allowed a container in the same network namespace to run new processes with elevated privileges. Affected releases are containerd before 1.3.9 and before 1.4.3; the vulnerability stems from e...

CVE-2020-12770

CVE-2020-12770 arises from the Linux kernel sg_write path in the SCSI generic (sg) driver not releasing internal resources in a specific error path because sg_remove_request is not called. This root cause is cited in multiple sources (e.g., ALAS2KERNEL-5.4-2022-012) and is described as a local-ac...

CVE-2020-2814

CVE-2020-2814 affects Oracle MySQL Server (InnoDB) with affected versions 5.6.47 and prior, 5.7.28 and prior, and 8.0.18 and prior. Bulletins in connected advisories describe an easily exploitable, network-accessible vulnerability enabling a high-privilege attacker to cause a hang or frequent cra...

CVE-2019-16519

CVE-2019-16519 affects ESET Cyber Security 6.7.900.0 for macOS. The vulnerability arises from abusing an undocumented feature in scheduled tasks, enabling a local attacker to execute unauthorized commands as root. The description is repeated across NVD and multiple vendor/ national vulnerability ...

CVE-2019-10913

CVE-2019-10913 affects the Symfony PHP framework's HTTP Foundation. Versions vulnerable include Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7. The issue: HTTP methods provided as verbs or via the X-Http-Method-Override header may be treat...

CVE-2015-0204

CVE-2015-0204 affects OpenSSL client code and enables a Man‑in‑the‑Middle downgrade attack (FREAK) by negotiating an export‑grade RSA key. Affected OpenSSL versions: 0.9.8z d and earlier; 1.0.0 up to but not including 1.0.0p; 1.0.1 up to but not including 1.0.1k. The vulnerability allows brute‑fo...

CVE-2002-0482

PCI Netsupport Manager (before v7) is affected by a directory traversal vulnerability in web extensions that allows an attacker to read arbitrary files via .. in an HTTP GET request. The issue arises from insufficient validation of path input in the web extension context, enabling access to files...

CVE-2024-8647

CVE-2024-8647 affects GitLab self-hosted installations, from versions 15.2 through 17.4.6, with 17.5 before 17.5.4 and 17.6 before 17.6.2. The issue enables leaking the anti-CSRF token to an external site when Harbor integration is enabled, indicating a cross-origin exposure vulnerability present...

CVE-2024-38202

CVE-2024-38202 describes an elevation of privilege in Windows Update that could allow a user with basic privileges to reintroduce mitigated vulnerabilities or bypass some VBS protections. The vulnerability requires an attacker to coax an Administrator or delegated user into performing a system re...

CVE-2024-26169

CVE-2024-26169 is a Windows Error Reporting Service Elevation of Privilege vulnerability (improper privilege management) that allows a local attacker with user permissions to gain SYSTEM privileges. Public exploits exist; the vulnerability has been added to CISA’s Known Exploited Vulnerabilities ...

CVE-2023-38594

The CVE-2023-38594 issue is a WebKitGTK/WebKitGTK+ vulnerability: processing web content could lead to arbitrary code execution. Connected advisories confirm a fixed version across multiple distributions and products (e.g., WebKitGTK/WebKitGTK+), with fixes described as “improved checks” or relat...

CVE-2023-23916

CVE-2023-23916 involves curl before 7.88.0 where an attacker could abuse the chained HTTP compression chain to create a degenerate decompression path. Although the cap on the number of links is per header, a malicious server can inject many headers to form an effectively unlimited decompression c...

CVE-2022-41715

CVE-2022-41715 concerns the Go regexp package. When er turning regular expressions from untrusted sources, parsing can exhaust memory and cause DoS, because the parsed representation is linear in input size and, in worst cases, the memory footprint can be very large. The available documents state...