28472 matches found
A Signed Length Overflow in Erlang/OTP's inet TCP Driver Overflows the Receive Buffer Into BEAM VM Memory From an Unauthenticated Peer
...
inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth
...
inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception
...
inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length
...
inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i
...
httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems
...
httpc does not bound server-supplied numeric header values before integer conversion
...
httpd applies no timeout while receiving a request body, parking a worker on a stalled client
...
eldap does not bound the port component of a referral URL before integer conversion
...
httpd parks a request worker indefinitely on a malformed chunk size sent after the headers
...
Memory exhaustion in query parameter parsing in net/url
...
httpd mod_auth directory protection bypassed by a doubled slash in the request path
...
inets,httpd:HTTP Request Smuggling via obs-fold Header Continuation
...
uri_string does not bound the port component of a URI before integer conversion
...
httpc memory exhaustion via unbounded response header accumulation
...
Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution
...
Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service
...
Missing Authorization in Elasticsearch Leading to Information Disclosure
...
FIPS mode assertion failure via malicious CERT payload
...
valkey-io valkey Blocked-on-keys blocked.c handleClientsBlockedOnKey use after free
...
gitoxide gix-packetline before 0.21.5 Denial of Service
...
gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodules
...
gitoxide before 0.69.0 Denial of Service via gix-pack
...
gitoxide before 0.82.0 Path Traversal via Submodule Name Validation Bypass
...
gitoxide before 0.52.1 Path Traversal via Submodule Name
...
RubyGems before 4.0.13 Path Traversal via Symlink Resolution
...
Rsyslog: rsyslog: denial of service via heap buffer overflow in rainerscript replace() function
...
Libsolv: libsolv: out-of-bounds write in repo_write() via unvalidated directory id from vertical/paged .solv filelist data
...
Gdk-pixbuf: gdk-pixbuf: invalid write in jpeg icc profile parser on error recovery
...
grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.
...
Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation
...
Tar: tar: hidden file injection via crafted archives
...
Popt-devel: popt-static: short realloc in poptconfigfiletostring
...
Sudo through 1.9.17p2 Intercept Policy Bypass via execveat
...
Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write
...
zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits
...
An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the libtiff/tools/thumbnail.c: main() component
...
GitHub CLI: `gh codespace ports forward` exposes forwarded services on all network interfaces by default
...
Emacs: local shell command injection through the user field in emacs tramp
...
sctp: validate Adaptation Indication parameter length
...
ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns()
...
tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions
...
drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE
...
i2c: amd-mp2: Unregister callback on adapter add failure
...
octeontx2-af: npc: Fix size of entry2cntr_map
...
EDAC/igen6: Fix call trace due to missing release()
...
s390/dasd: Fix potential NULL pointer dereference
...
dmaengine: idxd: fix double free of wq, engine, and group structs
...