CVE-2015-2806

CVE-2015-2806 is linked to an unspecified error in libtasn1/asn1_der_decoding within GnuTLS used by IBM Power Hardware Management Console (HMC). IBM’s bulletin lists the vulnerability as affecting Power HMC V7.9.0.0 with a base CVSS 6.8 (vector AV:N/AC:M/Au:N/C:P/I:P/A:P). Remediation provided vi...

CVE-2021-4079

CVE-2021-4079 refers to an out-of-bounds write in WebRTC within Google Chrome before version 96.0.4664.93, leading to potential heap corruption by crafted WebRTC packets. The connected security notices confirm the affected component as Chromium-based Chrome/WebRTC, with the vulnerability enabling...

CVE-2023-37211

CVE-2023-37211 involves memory safety bugs in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some bugs show memory corruption and could potentially be exploited to run arbitrary code. Affected versions are Firefox < 115, Firefox ESR < 102.13, and Thunderbird

CVE-2014-4258

CVE-2014-4258 affects the MySQL Server component in Oracle MySQL 5.5.37 and earlier and 5.6.17 and earlier, enabling remote authenticated users to impact confidentiality, integrity, and availability via SRINFOSC. Contained in multiple advisories; mitigations include upgrading MariaDB/Mysql-relate...

CVE-2014-4617

GnuPG DoS due to malformed compressed packets in do_uncompress (g10/compress.c). Affected: GnuPG 1.x before 1.4.17 and 2.x before 2.0.24. Attack uses crafted a3 01 5b ff sequence to trigger an infinite loop. Impact: denial of service. Remediation: upgrade to versions 1.4.17+ or 2.0.24+ where fixe...

CVE-2014-7817

CVE-2014-7817 affects the GLIBC wordexp function (glibc) where WRDE_NOCMD was not enforced, allowing context-dependent local attackers to execute arbitrary commands via input containing shell substitutions (e.g., $(...)). Public disclosures and vendor advisories (Debian/DSA-3142-1; CentOS CESA no...

CVE-2014-8150

CVE-2014-8150 is a CRLF injection flaw in libcurl 6.0–7.x prior to 7.40.0. When using an HTTP proxy, an attacker can inject arbitrary HTTP headers and trigger HTTP response splitting via CRLF sequences in the URL. The vulnerability is demonstrated in the public description: it affects libcurl and...

CVE-2015-0243

CVE-2015-0243 affects PostgreSQL and specifically its contrib/pgcrypto module. It is a buffer-overflow vulnerability in pgcrypto that, on vulnerable builds, could allow a remote authenticated user to crash the server and potentially execute arbitrary code via unspecified vectors. Affected version...

CVE-2015-4815

CVE-2015-4815 affects Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier, with remote authenticated access potentially impacting availability via DDL-related vectors. The F5 advisory notes multiple MySQL vulnerabilities across BIG-IP family, describing exposure when MySQL is provisione...

CVE-2015-7498

CVE-2015-7498 is a heap-based buffer overflow in the xmlParseXmlDecl function of libxml2’s parser.c, affecting versions before 2.9.3. The underlying issue enables context-dependent attackers to trigger a denial of service via crafted XML data, related to an encoding conversion failure. Affected p...

CVE-2017-1000115

Mercurial prior to 4.3 is vulnerable due to incomplete symlink auditing, which could allow a malicious repository to write files outside the repository. Multiple connected reports confirm the issue (CVE-2017-1000115) and describe path auditing weaknesses that could enable out-of-tree modification...

CVE-2017-14041

OpenJPEG 2.2.0 contains a stack-based buffer overflow in pgxtoimage (bin/jp2/convert.c). This out-of-bounds write vulnerability (CVE-2017-14041) may lead to remote denial of service and possibly remote code execution. Descriptions across multiple connected sources confirm the affected function an...

CVE-2017-17433

CVE-2017-17433 affects rsync 3.1.2 and 3.1.3-development prior to 2017-11/12; the daemon’s receive path (recv_files in receiver.c) updates file metadata before verifying the filename against the daemon_filter_list, allowing remote attackers to bypass access restrictions. Related advisories note t...

CVE-2018-0360

CVE-2018-0360 : in ClamAV before 0.100.1, an integer overflow in Hangul Word Processor (HWP) parsing causes an infinite loop via the function parsehwp3_paragraph() in libclamav/hwp.c . Affected version range is up to 0.100.0; remediation is to upgrade to 0.100.1 or newer (as documented by multipl...

CVE-2018-10101

CVE-2018-10101 affects WordPress up to version 4.9.4 where the URL validator incorrectly treated localhost hostnames as being on the same host as the WordPress server. This misclassification could enable a vulnerability scenario described across connected docs. Upgrading to WordPress 4.9.5 or lat...

CVE-2019-16159

CVE-2019-16159 affects BIRD Internet Routing Daemon: stack-based buffer overflow in the BGP admin shutdown message handling. Affected: bird 1.6.x up to 1.6.7 and 2.x up to 2.0.5. Root cause: incorrect logical expression when validating an administrative shutdown message enables a four-byte overfl...

CVE-2019-16781

WordPress CVE-2019-16781 affects WordPress versions before 5.3.1. Authenticated users with low privileges (e.g., contributors) can inject JavaScript in the block editor, which runs in the admin dashboard and can lead to an admin opening the affected post in the editor, enabling XSS. Remediation: ...

CVE-2019-18281

CVE-2019-18281 affects Qt qtbase 5.11.x and 5.12.x before 5.12.5, due to an out-of-bounds memory access in generateDirectionalRuns() in qtextengine.cpp. This can allow an attacker to cause a denial of service by crashing an application when processing a text file with many directional characters....

CVE-2019-19920

CVE-2019-19920 affects sa-exim 4.2.1: attackers who can write a .cf file or rule can trigger arbitrary code execution due to Greylisting.pm using eval. This is related to, and similar in behavior to, CVE-2018-11805. Documented impact is remote code execution with the required access to customize ...

CVE-2019-9718

CVE-2019-9718 is a DoS in FFmpeg’s subtitle decoder, affecting FFmpeg 3.2 and 4.1 via the Matroska subtitle path. The root cause is a complex format string in ff_htmlmarkup_to_ass in libavcodec/htmlsubtitles.c that enables consuming excessive CPU when parsing crafted Matroska subtitles. Public ad...

CVE-2020-10232

The Sleuth Kit (TSK) up to version 4.8.0 contains a stack buffer overflow in the YAFFS file timestamp parsing in yaffsfs_istat() (fs/yaffs.c). Affected component is the YAFFS timestamp parsing logic; impact is high (potential crash or exploitation as implied by CVSS). Remediation: upgrade to newe...

CVE-2020-16288

Ghostscript (Artifex) CVE-2020-16288 affects the 9.50 release. The vulnerability is a buffer overflow in pj_common_print_page() within devices/gdevpjet.c, exploitable by processing a crafted PDF file and capable of causing a denial of service. The issue is fixed in Ghostscript 9.51 (upgrade recom...

CVE-2020-1951

CVE-2020-1951 affects Apache Tika PSDParser (PSD parsing) in PSDParser versions 1.0–1.23, where a carefully crafted or corrupt PSD file can cause an infinite loop (Denial of Service). The provided connected documents confirm the affected component and root cause (infinite loop in PSDParser) but d...

CVE-2020-29483

CVE-2020-29483 — Xen 4.14.x (Xenstore/Xenstored issue) Affected component: Xenstore/Xenstored communication (guest–host via shared memory page). Root cause: If a guest violates the Xenstore protocol, xenstored drops the connection by removing the guest from its internal database and sending an @r...

CVE-2020-4047

CVE-2020-4047 is an authenticated XSS vulnerability in WordPress. According to the provided sources, in affected WordPress versions, users with upload permissions (e.g., authors) can inject JavaScript into certain media attachment pages, enabling script execution in the context of a higher-privil...

CVE-2021-37956

CVE-2021-37956 describes a use-after-free in Offline use in Google Chrome on Android prior to 94.0.4606.54, where a renderer compromise could potentially enable heap corruption via a crafted HTML page. The connected Debian advisory confirms this CVE is among multiple Chromium issues and provides ...

CVE-2021-37966

Technical details for CVE-2021-37966 are not publicly available in the provided connected documents. Monitor for updates; no confirmed exploit vectors, impacted products, or remediation details are present in these sources.

CVE-2021-3864

CVE-2021-3864 is a local privilege-escalation flaw in the Linux kernel involving how the dumpable flag is handled for descendants of certain SUID binaries. If a SUID binary sets real UID equal to effective UID and real GID equal to effective GID, the descendant’s dumpable value can become 1, so a...

CVE-2021-44040

CVE-2021-44040 affects Apache Traffic Server, with improper input validation in request line parsing allowing attackers to send invalid requests. Affected versions: 8.0.0–8.1.3 and 9.0.0–9.1.1. Severity is reflected as high in 3.1 metrics. Mitigation: remediation exists via vendor/debian advisori...

CVE-2021-45944

CVE-2021-45944 affects Ghostscript GhostPDL versions 9.50–9.53.3, with a use-after-free in sampled_data_sample (called from sampled_data_continue and interp). The vulnerability is described in the connected Astra/NVD entries for Ghostscript; the root cause is a use-after-free in the sampled_data_...

CVE-2022-39956

CVE-2022-39956 affects the OWASP ModSecurity Core Rule Set (CRS) and enables a partial rule set bypass for HTTP multipart requests when a payload uses certain character encoding schemes in Content-Type or Content-Transfer-Encoding headers. The issue impacts legacy CRS versions 3.0.x and 3.1.x, an...

CVE-2023-2462

The connected documents confirm CVE-2023-2462 affects Google Chrome/Chromium, tied to an inappropriate implementation in Prompts that allowed a remote attacker to obfuscate main origin data via a crafted HTML page. Impact is described as Medium; affected components relate to Chrome/Chromium promp...

CVE-2023-2879

CVE-2023-2879 affects Wireshark’s GDSDB dissector, causing an infinite loop and denial of service when processing certain packets or capture files. The vulnerability exists in Wireshark 4.0.0–4.0.5 and 3.6.0–3.6.13. Connected advisories confirm the issue and note that fixes have been released (e....

CVE-2024-27285

CVE-2024-27285 affects YARD, a Ruby documentation generator. The vulnerability lies in the generated frames.html, where inadequate sanitization in the JavaScript of the frames.erb template allowed Cross-Site Scripting (XSS). Public advisories (Debian, Fedora, Ubuntu, NVD) attribute the issue to Y...

CVE-2025-23144

The CVE-2025-23144 issue affects the Linux kernel backlight subsystem (led_bl/led_sysfs). Root cause: led_sysfs_enable() was not guaranteed to run with the led_access lock held, leading to a lockdep warning during led-backlight removal; the patch enforces holding the led_access lock when calling ...

CVE-2025-37995

CVSS note: CVE-2025-37995 is a Linux kernel issue with a local exploit vector and a MEDIUM impact rating. The vulnerability arises in module handling of kobjects: in lookup_or_create_module_kobject(), an internal kobject is created using module_ktype, and a call to kobject_put() on the error path...

CVE-2010-0395

CVE-2010-0395 affects OpenOffice.org 2.x/3.0 up to 3.2.0.x; a crafted OpenDocument Text file can bypass Python macro security restrictions and cause remote code execution by a user-assisted action when the macro directory is previewed. The underlying issue is insufficient enforcement of Python ma...

CVE-2014-1497

CVE-2014-1497 affects mozilla::WaveReader::DecodeAudioData in Mozilla Firefox up to 28.0 (and ESR 24.x up to 24.4), Thunderbird up to 24.4, and SeaMonkey up to 2.25. A crafted WAV file can cause information disclosure from process heap memory and can trigger a denial of service via an out-of-boun...

CVE-2014-8160

CVE-2014-8160 : In the Linux kernel, net/netfilter/nf_conntrack_proto_generic.c before 3.18 generates incorrect conntrack entries when handling certain iptables rule sets for SCTP, DCCP, GRE, and UDP-Lite. This can allow remote attackers to bypass intended access restrictions by sending packets w...

CVE-2015-8631

CVE-2015-8631 affects MIT Kerberos 5 (krb5) kadmind; a memory leak caused by the code path in kadmin/server/server_stubs.c can be triggered by a request with a NULL principal name. The issue, described as a denial of service via memory exhaustion, occurs in krb5 builds prior to 1.13.4 and in 1.14...

CVE-2015-8710

CVE-2015-8710 affects libxml2: denial of service and possible information disclosure from an out-of-bounds memory access when parsing an unclosed HTML comment. Publicly reported in multiple vendor advisories (IBM IMM/IMM2, RackSwitch, F5 BIG-IP, Rational DOORS, etc.). Remediation across products ...

CVE-2016-0775

Pillow (Python Imaging Library fork) contains a buffer overflow in ImagingFliDecode (libImaging/FliDecode.c) that affects versions before 3.1.1. A crafted FLI file can crash the process (DoS) or, per some sources, enable arbitrary code execution in affected contexts. The issue is documented acros...

CVE-2016-10155

CVE-2016-10155 describes a memory leak in QEMU’s watchdog driver (hw/watchdog/wdt_i6300esb.c) that can be exploited by local guest OS privileged users to cause host memory consumption and QEMU process crash (DoS) via a large number of unplug operations. The connected references (e.g., RHSA-2017:2...

CVE-2016-1834

CVE-2016-1834 describes a heap-based buffer overflow in libxml2's xmlStrncat function prior to 2.9.4, affecting Apple iOS/tvOS/watchOS and OS X before patched versions. Exploitation could lead to remote code execution or memory corruption and potential denial of service when processing crafted XM...

CVE-2016-2175

CVE-2016-2175 is an XXE vulnerability in Apache PDFBox. The issue arises because PDFBox’s XML parsers are not properly initialized when processing XML data inside PDFs, allowing context-dependent attackers to craft PDFs that cause XML External Entity (XXE) attacks. Affected products include PDFBo...

CVE-2017-11424

CVE-2017-11424 affects PyJWT 1.5.0 and earlier, where the invalid_strings check in HMACAlgorithm.prepare_key fails to account for all PEM public-key formats (notably PKCS1 PEM prefixed with -----BEGIN RSA PUBLIC KEY-----), enabling key confusion attacks that could let an attacker craft JWTs from ...

CVE-2017-12178

CVE-2017-12178 affects xorg-server (Xi component) due to an invalid/incorrect length check in ProcXIChangeHierarchy. Exploitation could crash the X server or allow arbitrary code execution. Public advisories and CVE trackers show impact on xorg-server prior to version 1.19.5. Remediation across m...

CVE-2017-13004

CVE-2017-13004 affects tcpdump prior to 4.9.2, where the Juniper protocols parser (print-juniper.c, juniper_parse_header) can trigger a buffer over-read. This could lead to information disclosure or crash under crafted input. Affected software: tcpdump. Mitigation: upgrade to tcpdump 4.9.2 or app...

CVE-2017-14246

CVE-2017-14246 affects libsndfile 1.0.28, where an out-of-bounds read in the function d2ulaw_array() (ulaw.c) can allow a remote attacker to cause a denial of service or disclose information due to mishandling of NAN/INFINITY. Connected sources confirm the issue is tied to the d2ulaw_array/d2alaw...

CVE-2017-3138

CVE-2017-3138 affects the BIND/named control channel. A regression can cause named to exit with a REQUIRE assertion failure when it receives a null command string on the control channel, potentially enabling denial-of-service. Affected versions in the CVE scope include BIND 9.9.9 through 9.11.1rc...