28400 matches found
Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape
...
Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite
...
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: integer overflow in TProtocol::checkReadBytesAvailable()
...
Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport
...
python-cryptography: Duplicate self-signed intermediates can cause exponential path-building
...
Apache Thrift: C++ heap out-of-bounds read in THeaderTransport::readHeaderFormat()
...
xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()
...
nexthop: initialize extack in nh_res_bucket_migrate()
...
Stunnel: ssrf bypass in stunnel socks proxy via ipv4-mapped ipv6 loopback and unspecified addresses allows access to loopback-only services
...
Apache Thrift: Python TSSLSocket Hostname Matcher Import
...
xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert
...
Stunnel: stack-based out-of-bounds read/write in stunnel s_vlog via oversized log message
...
wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
...
Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass
...
smb/client: Fix error code in smb2_aead_req_alloc()
...
ksmbd: validate compound request size before reading StructureSize2
...
nvmet-tcp: Fix potential UAF when ddgst mismatch
...
btrfs: do not trim a device which is not writeable
...
MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure
...
crypto: amlogic - avoid double cleanup in meson_crypto_probe()
...
fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}
...
nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path
...
undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
...
net: openvswitch: reject oversized nested action attrs
...
usb: gadget: f_midi: cancel pending IN work before freeing the midi object
...
undici vulnerable to CRLF Injection via blob-like body 'type' property
...
fs/ntfs3: validate lcns_follow in log_replay conversion
...
Double-free in the iSNS attribute decoder in open-iscsi
...
wifi: brcmfmac: drain bus_reset work on device removal
...
staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
...
iscsiuio control-socket authentication bypass in open-iscsi
...
usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown
...
remote limited file-write as root via discovery in open-iscsi
...
KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
...
sigstore-go fails to check signature timestamps against a signing key's validity period
...
dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning
...
can: esd_usb: kill anchored URBs before freeing netdevs
...
smb: client: fix double-free in SMB2_close() replay
...
cJSON JSON Patch copy/add Uncontrolled Recursion Stack Exhaustion
...
Apache Portable Runtime Utility: apr-util XML stack recursion crash
...
Popt-devel: popt-static: size_t underflow in singleoptionhelp
...
cJSON cJSON_Compare Exponential Complexity Denial of Service
...
Popt-devel: popt-static: off-by-one in poptstuffargs
...
KVM: nVMX: Hide shadow VMCS right after VMCLEAR
...
HDF5 H5Pget_fill_value NULL Pointer Dereference via Malformed Fill Value Message
...
Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()
...
Nbit filter NULL/short parameter-array dereference
...
sctp: don't free the ASCONF's own transport in DEL-IP processing
...