CVE-2022-39253

Summary (facts grounded to provided docs): CVE-2022-39253 affects Git versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, exposing sensitive data via local clones where source and target are on the same volume. The vulnerability arises when cloning a repository l...

CVE-2019-3466

CVE-2019-3466 concerns the pg_ctlcluster script in the PostgreSQL-related package postgresql-common. In versions prior to 210, the script did not drop privileges when creating socket/statistics temporary directories, enabling a local privilege escalation. Public disclosures reference Ubuntu/Debia...

CVE-2015-3152

The CVE-2015-3152 issue affects MySQL client libraries where the --ssl flag is treated as optional, allowing a MITM downgrade to cleartext SSL and server spoofing. Affected products/versions include Oracle MySQL prior to 5.7.3, Oracle MySQL Connector/C (libmysqlclient) prior to 6.1.3, and MariaDB...

CVE-2019-2684

CVE-2019-2684 concerns Oracle Java SE and Java SE Embedded, specifically the RMI component. The connected Chainguard entry shows affected packages for OpenJDK builds (openjdk-21/openj9, openjdk-8/openj9, openjdk-11/openj9, openjdk-17/openj9). The initial description identifies affected Oracle Jav...

CVE-2021-25215

CVE-2021-25215 affects BIND 9 upstream and downstream builds. The vulnerability is an assertion failure in the named process when handling DNAME-related queries, which can cause named to terminate. Affected versions include BIND 9.0.0–9.11.29, 9.12.0–9.16.13, and specific S1/“Supported Preview” b...

CVE-2012-0031

CVE-2012-0031 affects Apache HTTP Server 2.2.21 and earlier, specifically scoreboard.c. The vulnerability allows local users to cause a denial of service (daemon crash during shutdown) or potentially other unspecified impact by modifying a type field in a shared scoreboard Memory segment, which l...

CVE-2021-23336

CVE-2021-23336 affects Python CPython across multiple branches (0 and before 3.6.13; 3.7.0 before 3.7.10; 3.8.0 before 3.8.8; 3.9.0 before 3.9.2). The vulnerability is Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs using parameter cloaking with semicolons, causing the pr...

CVE-2022-42003

The CVE-2022-42003 issue affects FasterXML jackson-databind, where enabling UNWRAP_SINGLE_VALUE_ARRAYS allows resource exhaustion due to a missing check in primitive value deserializers to prevent deep wrapper array nesting. Affected versions are before 2.13.4.1 and 2.12.17.1; remediation per sou...

CVE-2020-1967

CVE-2020-1967 describes a NULL pointer dereference in OpenSSL’s SSL_check_chain() during or after a TLS 1.3 handshake, caused by incorrect handling of the signature_algorithms_cert extension. A malicious peer sending an invalid/unrecognized signature algorithm can crash the server/client, enablin...

CVE-2020-8450

CVE-2020-8450 affects Squid prior to 4.10, caused by incorrect buffer management in reverse-proxy mode, allowing a remote client to trigger a buffer overflow. Connected advisories confirm a fix was released (e.g., updates to Squid 4.11+/4.10-era patches) across multiple distributions (CloudLinux,...

CVE-2025-47273

CVE-2025-47273 affects setuptools by a path traversal in PackageIndex prior to 78.1.1, allowing writing files to arbitrary locations with the process’s permissions and potentially enabling remote code execution in context. Affected: setuptools package (Python ecosystem). The issue is fixed in ver...

CVE-2021-3449

CVE-2021-3449 affects OpenSSL 1.1.1.x where a TLSv1.2 server may crash (DoS) if it receives a renegotiation ClientHello that omits the signature_algorithms extension but includes signature_algorithms_cert. The issue is a NULL pointer dereference leading to a denial of service; OpenSSL clients are...

CVE-2020-25683

CVE-2020-25683 affects dnsmasq up to version 2.83. Root cause: heap-based buffer overflow in DNSSEC processing due to missing length checks in rfc1035.c:extract_name() and related get_rdata()/sort_rrset paths. Exploitation: remote attacker can craft valid DNS replies to cause a heap overflow, cra...

CVE-2020-25694

CVE-2020-25694 affects PostgreSQL clients/servers prior to versions 13.1, 12.5, 11.10, 10.15, 9.6.20 and 9.5.24. The issue allows a reconnection that downgrades security settings, enabling potential MITM or observation of clear-text transmissions, with impact to confidentiality, integrity, and av...

CVE-2021-37712

CVE-2021-37712 affects the npm package node-tar (tar). The issue arises from insufficient symlink protection during extraction: a directory cache could be poisoned by a misrepresented path when a tar contains a directory and a symlink whose names Unicode-normalize to the same value, bypassing che...

CVE-2021-4189

CVE-2021-4189 affects Python’s FTP (ftplib) client: in PASV mode it trusts the host from the PASV response by default, enabling a malicious FTP server to trick clients into connecting back to an attacker-specified IP/port (potential port scanning). Debian LTS postings and other advisories explici...

CVE-2020-11724

CVE-2020-11724 affects OpenResty up to version 1.15.8.3 (and presumably earlier OpenResty/nginx Lua module builds) where ngx_http_lua_subrequest.c allows HTTP request smuggling via ngx.location.capture. The NVD entry documents CVSS scores (2.0/5.0 and 3.1/7.5) with network access and no authentic...

CVE-2020-25696

The CVE-2020-25696 issue affects the PostgreSQL psql interactive terminal. A flaw in psql’s \gset handling during queries can allow an attacker to execute arbitrary code with the OS account running psql, compromising confidentiality, integrity, and availability. Affected PostgreSQL client/server ...

CVE-2018-15494

CVE-2018-15494: Dojo Toolkit’s DataGrid in Dojo before 1.14 is vulnerable to unescaped string injection, enabling cross‑site scripting. Affected component is dojox/Grid/DataGrid; impact is client-side script execution in the context of the hosting page. The public fix is to upgrade to Dojo 1.14 o...

CVE-2020-8619

CVE-2020-8619 affects ISC BIND9: versions 9.11.14–9.11.19, 9.14.9–9.14.12, and 9.16.0–9.16.3 are vulnerable. The root cause is an asterisk (*) in an empty non-terminal location in the DNS graph, which can trigger an assertion in rbtdb.c and cause denial of service. Exploitation would require zone...

CVE-2021-27928

MariaDB and Percona Server are affected by CVE-2021-27928: an untrusted search path enables eval injection, allowing a database SUPER user to execute OS commands after altering wsrep_provider and wsrep_notify_cmd. Affected versions: MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10...

CVE-2022-41742

CVE-2022-41742 affects NGINX ngx_http_mp4_module when mp4 is enabled; a crafted MP4 file can cause local memory disclosure or worker crashes. Affected: NGINX Open Source before 1.23.2 and 1.22.1, NGINX Open Source Subscription before R2 P1/R1 P1, and NGINX Plus before R27 P1/R26 P1. Root cause: p...

CVE-2024-46981

CVE-2024-46981 affects Redis where an authenticated user using a crafted Lua script can manipulate the Lua garbage collector, potentially leading to remote code execution. Affected Redis versions are fixed in 7.4.2, 7.2.7, and 6.2.17; advisories also note an added mitigation: restricting Lua exec...

CVE-2022-21724

CVE-2022-21724 affects the official PostgreSQL JDBC Driver (libpgjava) used by pgjdbc. The vulnerability stems from the driver instantiating plugin classes based on connection properties (authenticationPluginClassName, sslhostnameverifier, socketFactory, sslfactory, sslpasswordcallback) without v...

CVE-2011-3389

CVE-2011-3389 is the BEAST information-disclosure vulnerability in TLS/SSL CBC-mode encryption, allowing a network attacker to glean plaintext headers under certain configurations (e.g., when CBC with chained IVs is used and the attacker can inject/observe traffic). The connected documents show m...

CVE-2016-3714

CVE-2016-3714 affects ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1. An improper input validation flaw in the EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders allows a remote attacker to execute arbitrary code via shell metacharacters in a crafted image (ImageTragick). The vulnera...

CVE-2023-41993

CVE-2023-41993 is a WebKit code‑execution vulnerability affecting Apple platforms where processing web content could trigger arbitrary code execution. The public record notes the issue was fixed in macOS Sonoma 14 and is associated with Safari/WebKit processing paths. Apple documents indicate the...

CVE-2022-0235

CVE-2022-0235 affects the node-fetch package and is described as a vulnerability that could result in Exposure of Sensitive Information to an Unauthorized Actor. The connected document(s) confirm this CVE ID and provide contextual metrics (e.g., CVSS scores from NVD and related references), but d...

CVE-2024-9680

CVE-2024-9680 is a use-after-free in the Animation timelines that enables code execution in the content process. Affected Mozilla products include Firefox and Thunderbird with the following vulnerable versions: Firefox < 131.0.2; Firefox ESR < 128.3.1; Firefox ESR < 115.16.1; Thunderbird...

CVE-2020-25695

CVE-2020-25695 affects PostgreSQL across multiple versions (pre-13.1, pre-12.5, pre-11.10, pre-10.15, pre-9.6.20, pre-9.5.24). The issue allows an attacker who can create non-temporary objects in at least one schema to execute arbitrary SQL functions as a superuser, impacting data confidentiality...

CVE-2021-23840

CVE-2021-23840 describes an integer-length overflow in EVP_CipherUpdate, EVP_EncryptUpdate, and EVP_DecryptUpdate that can cause a negative output length value when input length is near the platform’s integer limit. This can lead to application crashes or incorrect behavior. Affected OpenSSL rele...

CVE-2019-7317

CVE-2019-7317 is a use-after-free involving png_image_free in libpng. A connected document ties this to the FLTK package, affecting versions less than 1.3.8-1, and states that upgrading to a later FLTK version resolves the issue. If applying this advisory, upgrade FLTK to 1.3.8-1 or newer for rem...

CVE-2023-45866

CVE-2023-45866 affects BlueZ Bluetooth HID Hosts. The description states that an unauthenticated Peripheral role HID Device could initiate, establish an encrypted connection, and send HID keyboard reports, potentially injecting HID messages when there is no user interaction in the Central role to...

CVE-2019-9512

CVE-2019-9512 is a HTTP/2 denial-of-service issue caused by ping floods that can trigger unbounded memory/CPU growth. Connected advisories confirm concrete remediation paths across environments: for Go-based HTTP/2 stacks, upgrading Go to 1.12.8 or newer (addresses CVE-2019-9512/9514 and related ...

CVE-2020-35730

Roundcube Webmail contains a cross-site scripting (XSS) vulnerability in rcube_string_replacer.php (linkref_addindex). An attacker can embed JavaScript in a plain-text email link reference, leading to script execution in the victim’s browser. Affected: Roundcube <1.2.13, <1.3.16 for 1.3.x, ...

CVE-2025-32433

The CVE-2025-32433 issue affects Erlang/OTP’s SSH server and is caused by a flaw in SSH message handling during authentication, enabling an unauthenticated attacker to execute arbitrary commands with the SSH daemon’s privileges (potentially root). Affected OTP versions include OTP-27.3.2?3, OTP-2...

CVE-2016-2107

CVE-2016-2107 (OpenSSL) is a padding-oracle vulnerability in the AES-NI CBC MAC check. The issue arises in the AES-CBC padding validation where memory allocation during the padding check is mishandled, enabling potential leakage of plaintext under certain conditions. Affected OpenSSL versions inc...

CVE-2021-37701

CVE-2021-37701 (node-tar) affects the tar handling in node-tar where symlink-based directory cache poisoning enables arbitrary file creation/overwrite during extraction. The vulnerability arises from insufficient protection when an archive contains a directory followed by a symlink that shares th...

CVE-2016-6662

CVE-2016-6662 affects MySQL-derived products (MySQL, MariaDB, Percona Server) across multiple branches, allowing local users to bypass protections by setting general_log_file to a my.cnf configuration. The underlying flaw enables arbitrary configuration by non-privileged users and can be leverage...

CVE-2023-4431

CVE-2023-4431 describes an out-of-bounds memory access in Google Chrome Fonts that allowed a remote attacker to perform an out-of-bounds memory read via a crafted HTML page. The issue affects Chrome/Chromium prior to version 116.0.5845.110. The CVSS v3.1 vector indicates network access, low attac...

CVE-2021-3468

CVE-2021-3468 affects the Avahi package: versions 0.6 through 0.8 contain a flaw where the event signaling termination of a client connection on the Avahi Unix socket is mishandled in client_work, allowing a local attacker to trigger an infinite loop. The primary impact is availability, with the ...

CVE-2019-14816

CVE-2019-14816 is a Linux kernel heap-based buffer overflow in the mwifiex (Marvell) wifi driver that affects all versions up to, but excluding, 5.3. It enables a local attacker to crash the system or potentially execute arbitrary code via the Marvell wifi chip driver; affected scope is the kerne...

CVE-2022-25647

CVE-2022-25647 affects com.google.code.gson:gson before 2.8.9, which is vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, potentially enabling DoS. Public advisories (e.g., Debian DSA-5227-1) confirm the flaw and recommend upgrading to 2.8.9 or new...

CVE-2023-21930

CVE-2023-21930 affects Oracle Java SE and GraalVM Enterprise Edition (JSSE component) on Java 8u361, 11.0.18, 17.0.6, 20 and GraalVM 20.3.9/21.3.5/22.3.1. An unauthenticated attacker with network access over TLS can compromise data confidentiality and integrity; exploitation is possible via TLS h...

CVE-2023-3823

CVE-2023-3823 affects PHP versions 8.0.x before 8.0.30, 8.1.x before 8.1.22, and 8.2.x before 8.2.8. The issue stems from libxml global state tracking of configuration (e.g., external entities); in shared-process scenarios (e.g., ImageMagick in the same process), this state can be altered and per...

CVE-2024-23672

Summary: CVE-2024-23672 is a Denial of Service vulnerability in Apache Tomcat affecting multiple branches (11.0.0-M1…16, 10.1.0-M1…18, 9.0.0-M1…85, 8.5.0…98) where WebSocket clients could keep connections open, leading to increased resource consumption. The connected documents confirm the root ca...

CVE-2019-11042

CVE-2019-11042 affects PHP’s EXIF extension when parsing EXIF data (exif_read_data) across PHP 7.1.x < 7.1.31, 7.2.x < 7.2.21, and 7.3.x

CVE-2023-28756

CVE-2023-28756 describes a ReDoS vulnerability in the Ruby Time parser up to version 3.2.1. The Time parser mishandles invalid URLs containing certain characters, causing increased execution time when parsing strings to Time objects. Affected product: Ruby Time component (through Ruby up to 3.2.1...

CVE-2025-49113

CVE-2025-49113 affects Roundcube Webmail (Roundscube core) with PHP Object Deserialization via the unvalidated _from parameter in actions/settings/upload.php. The issue allows remote code execution by an authenticated user. Public advisories confirm RCE implications and that patches were released...

CVE-2020-17527

CVE-2020-17527 affects multiple Apache Tomcat releases where HTTP/2 stream handling could cause information leakage by reusing an HTTP request header value from a previous stream for the next stream. Affected products/versions include Tomcat 10.0.0-M1–M9, 9.0.0-M1–9.0.39, and 8.5.0–8.5.59; the is...