6612 matches found
FreeBSD -- Buffer overflow in some filesystems via NFS
Problem Description: In order to export a file system via NFS, the file system must define a file system identifier FID for all exported files. Each FreeBSD file system implements operations to translate between FIDs and vnodes, the kernel's in-memory representation of files. These operations are...
FreeBSD -- OpenSSH Keystroke Obfuscation Bypass
Problem Description: A logic error in the ssh1 ObscureKeystrokeTiming feature on by default rendered this feature ineffective. Impact: A passive observer could detect which network packets contain real keystrokes, and infer the specific characters being transmitted from packet timing...
postorius -- XSS
NIST reports: Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild in May 2026...
Vaultwarden -- Multiple vulnerabilities
The Vaultwarden project reports: RCE in the admin panel. Getting access to the Admin Panel via CSRF. Escalation of privilege via variable confusion in OrgHeaders trait...
electron32 -- multiple vulnerabilities
Electron developers report: This update fixes the following vulnerabilities: Security: backported fix for CVE-2024-12693. Security: backported fix for CVE-2024-12694. Security: backported fix for CVE-2024-12695. Security: backported fix for CVE-2025-0434. Security: backported fix for CVE-2025-043...
clamav -- Possbile denial-of-service vulnerability
The ClamAV project reports: A possible buffer overflow read bug is found in the OLE2 file parser that could cause a denial-of-service DoS condition...
electron33 -- multiple vulnerabilities
Electron developers report: This update fixes the following vulnerabilities: Security: backported fix for CVE-2025-0434. Security: backported fix for CVE-2025-0436. Security: backported fix for CVE-2025-0437...
chromium -- multiple security fixes
Chrome Releases reports: This update includes 3 security fixes: 386143468 High CVE-2025-0611: Object corruption in V8. Reported by 303f06e3 on 2024-12-26 385155406 High CVE-2025-0612: Out of bounds memory access in V8. Reported by Alan Goodman on 2024-12-20...
Gitlab -- Vulnerabilities
Gitlab reports: Stored XSS via Asciidoctor render Developer could exfiltrate protected CI/CD variables via CI lint Cyclic reference of epics leads resource exhaustion...
py-mysql-connector-python -- Vulnerability in the MySQL Connectors product of Oracle MySQL
Oracle reports: Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/Python. Supported versions that are affected are 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL...
chromium -- multiple security fixes
Chrome Releases reports: This update includes 2 security fixes: 384844003 Medium CVE-2025-0762: Use after free in DevTools. Reported by Sakana.S on 2024-12-18...
dendrite -- Server-side request forgery vulnerability
Dendrite team reports: This is a security release, gomatrixserverlib was vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions...
electron31 -- multiple vulnerabilities
Electron developers report: This update fixes the following vulnerabilities: Security: backported fix for CVE-2024-12053. Security: backported fix for CVE-2024-12693. Security: backported fix for CVE-2024-12694...
rsync -- Multiple security fixes
rsync reports: This update includes multiple security fixes: CVE-2024-12084: Heap Buffer Overflow in Checksum Parsing CVE-2024-12085: Info Leak via uninitialized Stack contents defeats ASLR CVE-2024-12086: Server leaks arbitrary client files CVE-2024-12087: Server can make client write files...
oauth2-proxy -- Non-linear parsing of case-insensitive content
Golang reports: This update include security fixes: CVE-2024-45338: Non-linear parsing of case-insensitive content...
chromium -- multiple security fixes
Chrome Releases reports: This update includes 16 security fixes: 374627491 High CVE-2025-0434: Out of bounds memory access in V8. Reported by ddme on 2024-10-21 379652406 High CVE-2025-0435: Inappropriate implementation in Navigation. Reported by Alesandro Ortiz on 2024-11-18 382786791 High...
keycloak -- Multiple security fixes
Keycloak reports: This update includes 2 security fixes: CVE-2024-11734: Unrestricted admin use of system and environment variables CVE-2024-11736: Denial of Service in Keycloak Server via Security Headers...
fcgi -- Heap-based buffer overflow via crafted nameLen/valueLen in ReadParams
[email protected] reports: FastCGI fcgi2 aka fcgi 2.x through 2.4.4 has an integer overflow and resultant heap-based buffer overflow via crafted nameLen or valueLen values in data to the IPC socket. This occurs in ReadParams in fcgiapp.c...
qt6-webengine -- Multiple vulnerabilities
Qt qtwebengine-chromium repo reports: Backports for 9 security bugs in Chromium: CVE-2024-12693: Out of bounds memory access in V8 CVE-2024-12694: Use after free in Compositing CVE-2025-0436: Integer overflow in Skia CVE-2025-0437: Out of bounds read in Metrics CVE-2025-0438: Stack buffer overflo...
Gitlab -- Vulnerabilities
Gitlab reports: Possible access token exposure in GitLab logs Cyclic reference of epics leads resource exhaustion Unauthorized user can manipulate status of issues in public projects Instance SAML does not respect externalprovider configuration...
Mozilla -- Memory corruption bug
[email protected] reports: Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code...
Mozilla -- use-after-free after failed memory allocation
[email protected] reports: Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, leading to a potentially exploitable crash...
Mozilla -- use-after-free while parsing JSON
[email protected] reports: Parsing a JavaScript module as JSON could, under some circumstances, cause cross-compartment access, which may result in a use-after-free...
Mozilla -- privilege escalation attack
[email protected] reports: The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks...
go -- multiple vulnerabilities
The Go project reports: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. net/http: sensitive headers incorrectly sent after...
Mozilla -- Memory safety bugs
[email protected] reports: Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been...
firefox -- authentication bypass
[email protected] reports: Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed...
Mozilla -- Memory safety bugs
[email protected] reports: Memory safety bugs present in Firefox 133 and Thunderbird 133. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code...
Mozilla -- redirection to insecure site
[email protected] reports: When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site...
Mozilla -- DoS via segmentation fault
[email protected] reports: When segmenting specially crafted text, segmentation would corrupt memory leading to a potentially exploitable crash...
redis,valkey -- Denial-of-service valnerability due to malformed ACL selectors
Redis core team reports: An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service.The problem exists in Redis 7.0.0 or newer...
redis,valkey -- Remote code execution valnerability
Redis core team reports: An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting...
electron32 -- Type Confusion in V8
Electron developers report: This update fixes the following vulnerability: Security: backported fix for CVE-2024-12053...
webmin -- CGI Command Injection Remote Code Execution
Webmin reports: A less-privileged Webmin user can execute commands as root via a vulnerability in the shell autocomplete feature...
Apache Tomcat -- RCE due to TOCTOU issue in JSP compilation
[email protected] reports: Time-of-check Time-of-use TOCTOU Race Condition The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file system with the default servlet write enabled readonly initialisation parameter set to the non-default value of false may...
Vaultwarden -- Admin organization permissions
The Vaultwarden project reports: Admins from any organization were able to modify or delete groups in any other organization if they know the group's uuid...
kanboard -- Insufficient session invalidation
[email protected] reports: Kanboard is project management software that focuses on the Kanban methodology. In affected versions sessions are still usable even though their lifetime has exceeded. Kanboard implements a cutom session handler app/Core/Session/SessionHandler.php, to store...
age -- age vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution
Filippo Valsorda reports: A plugin name containing a path separator may allow an attacker to execute an arbitrary binary. Such a plugin name can be provided to the age CLI through an attacker-controlled recipient or identity string, or to the plugin.NewIdentity, plugin.NewIdentityWithoutData, or...
chromium -- multiple security fixes
Chrome Releases reports: This update includes 3 security fixes: 382291459 High CVE-2024-12692: Type Confusion in V8. Reported by Seunghyun Lee @0x10n on 2024-12-05 382190919 High CVE-2024-12693: Out of bounds memory access in V8. Reported by 303f06e3 on 2024-12-04 368222741 High CVE-2024-12694: U...
www/varnish7 -- client-side desync vulnerability
The Varnish Development Team reports: A client-side desync vulnerability can be triggered in Varnish Cache and Varnish Enterprise. This vulnerability can be triggered under specific circumstances involving malformed HTTP/1 requests...
zeek -- potential DoS vulnerability
Tim Wojtulewicz of Corelight reports: Large QUIC packets can cause Zeek to overflow memory and potentially crash. Due to the possibility of receiving these packets from remote hosts, this is a DoS risk...
forgejo -- multiple vulnerabilities
Problem Description: When Forgejo is configured to run the internal ssh server with server.STARTSSHSERVER=true, it was possible for a registered user to impersonate another user. The rootless container image uses the internal ssh server by default and was vulnerable. A Forgejo instance running fr...
gitea -- Fix misuse of PublicKeyCallback
Problem Description: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto...
forgejo -- unauthorized user impersonation
Problem Description: When Forgejo is configured to run the internal ssh server with server.STARTSSHSERVER=true, it was possible for a registered user to impersonate another user. The rootless container image uses the internal ssh server by default and was vulnerable. A Forgejo instance running fr...
forgejo -- multiple vulnerabilities
Problem Description: It was possible to use a token sent via email for secondary email validation to reset the password instead. In other words, a token sent for a given action registration, password reset or secondary email validation could be used to perform a different action. It is no longer...
Gitlab -- Vulnerabilities
Gitlab reports: Injection of Network Error Logging NEL headers in kubernetes proxy response could lead to ATO abusing OAuth flows Denial of Service by repeatedly sending unauthenticated requests for diff-files CIJOBTOKEN could be used to obtain GitLab session Open redirect in releases API...
chromium -- multiple security fixes
Chrome Releases reports: This update includes 3 security fixes: 381696874 High CVE-2024-12381: Type Confusion in V8. Reported by Seunghyun Lee @0x10n on 2024-12-02 379516109 High CVE-2024-12382: Use after free in Translate. Reported by lime@limeSec from TIANGONG Team of Legendsec at QI-ANXIN Grou...
gstreamer1-plugins-vorbis -- Stack buffer-overflow in Vorbis decoder
The GStreamer Security Center reports: Stack buffer-overflow in Vorbis decoder that can cause crashes for certain input files...
gstreamer1-plugins-good -- multiple vulnerabilities
The GStreamer Security Center reports: 20 security bugs. CVE-2024-47537: Integer overflow in MP4/MOV sample table parser leading to out-of-bounds writes CVE-2024-47598: MP4/MOV sample table parser out-of-bounds read CVE-2024-47539: MP4/MOV Closed Caption handling out-of-bounds write CVE-2024-4754...