CVE-2012-0867

CVE-2012-0867 affects PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3. The vulnerability truncates the SSL certificate common name to 32 characters when verifying hostnames, enabling remote attackers to spoof connections if the hostname is exactly 32 characters. This is...

CVE-2017-1000256

CVE-2017-1000256 affects libvirt 2.3.0 and later. The issue arises from a default TLS configuration where verify-peer=no is passed to QEMU by libvirt, causing failure to validate SSL/TLS certificates by default. Several advisories indicate TLS client/server certificate verification could be disab...

CVE-2025-23161

CVE-2025-23161 : In the Linux kernel, the PCI vmd driver fixed a lock context issue by changing vmd_dev::cfg_lock from spinlock_t to raw_spinlock_t so it can be used with interrupts disabled in PREEMPT_RT contexts. This avoids a sleeping-lock scenario when accessing PCI config space via pci_ops r...

CVE-2025-3887

CVE-2025-3887 affects the GStreamer Gst-plugins-bad1.0 H.265 codec parser. The flaw is a stack-based buffer overflow caused by insufficient validation of user-supplied data length before copying to a fixed-length buffer in the H.265 slice header parsing. This can lead to remote code execution in ...

CVE-2007-0009

CVE-2007-0009 describes a stack-based buffer overflow in the SSLv2 handling of the Mozilla Network Security Services (NSS) library, caused by improper handling of the Client Master Key length values. This can enable remote attackers to execute arbitrary code in the context of the affected process...

CVE-2008-4359

CVE-2008-4359 affects lighttpd before 1.4.20. The vulnerability arises because URIs are compared against url.redirect/url.rewrite patterns prior to URL decoding, potentially bypassing access restrictions and allowing leakage of information or data modification. IBM’s IMM advisory confirms this CV...

CVE-2014-4344

The MIT Kerberos SPNEGO acceptor (lib/gssapi/spnego/spnego_mech.c, krb5 1.5.x–1.12.x before 1.12.2) is affected by CVE-2014-4344 due to a NULL pointer dereference when processing an empty continuation token during SPNEGO negotiation, enabling remote, unauthenticated denial of service (server cras...

CVE-2015-4858

Technical details for CVE-2015-4858 are not publicly available in the provided documents. Monitor for updates from vendors and security advisories.

CVE-2015-8779

CVE-2015-8779 affects the GNU C Library (glibc). The vulnerability is a stack-based buffer overflow in the catopen() function when handling long catalog names, which can cause an application crash (DoS) or potentially allow arbitrary code execution. Affected products include glibc releases prior ...

CVE-2016-2831

Mozilla Firefox and Firefox ESR are affected by CVE-2016-2831 where an error during fullscreen and pointerlock handling (and window closing) could allow a pointerlock in a fullscreen window without user permission, enabling UI outage, spoofing, and clickjacking. A fix is available in later Firefo...

CVE-2017-13711

CVE-2017-13711 : Use-after-free in QEMU’s Slirp implementation (slirp/socket.c, function sofree) can trigger a QEMU instance crash (DoS) when pending packets’ ifq_so is not properly cleared. The connected Nessus records (MiracleLinux AXSA-2018-2655:03) enumerate this CVE among others affected by ...

CVE-2017-6932

Drupal core 7.x versions before 7.57 are affected by an external link injection vulnerability in the language switcher block, potentially letting an attacker trick users into navigating to an external site. Affected modules may also exist. Remediation: upgrade to Drupal core 7.57 or later (or app...

CVE-2017-9775

CVE-2017-9775 affects Poppler (pdftocairo) with a stack-based buffer overflow in GfxState.cc; impacts include application crash and potential code execution when processing crafted PDFs. The issue is documented across multiple advisories, with mitigations naming upgrades to Poppler 0.56+ (and lat...

CVE-2018-12617

Technical details about CVE-2018-12617 are not publicly provided in the Connected documents. The Initial description notes an integer overflow in QEMU-GA, but there is no accompanying vendor/security advisory content in the Connected documents to confirm specifics.

CVE-2018-13982

Smarty path traversal vulnerability CVE-2018-13982 affects Smarty6’s template engine (Smarty) via isTrustedResourceDir() in versions prior to 3.1.33, allowing an attacker controlling template code to read arbitrary files due to insufficient sanitization. The issue is brought up across multiple ad...

CVE-2018-16541

Ghostscript before 9.24 is affected by CVE-2018-16541 due to incorrect free logic in pagedevice replacement when processing crafted PostScript files, which can crash the interpreter. Affected products in public advisories include Ghostscript packages across several distributions (e.g., CentOS 7, ...

CVE-2018-17462

CVE-2018-17462 concerns Google Chrome before 70.0.3538.67, where incorrect refcounting in AppCache could allow a remote attacker to escape the browser sandbox via a crafted HTML page. The practical impact is sandbox escape, enabling potential access to privileged context from a web page. Connecte...

CVE-2018-17477

CVE-2018-17477 affects Chromium/Google Chrome extensions UI: a UI spoofing vulnerability in the extensions pane allows a remote attacker to spoof extension popups via a crafted page. Root cause is a UI spoofing vulnerability in the Extensions component present before version 70.0.3538.67. Exploit...

CVE-2018-19216

Summary: CVE-2018-19216 affects NASM with a use-after-free in detoken (asm/preproc.c). Connected advisories document multiple NASM-related CVEs for NASM versions around 2.13.x/2.14.x and show heap-based/stack-based over-read or under-read in various preprocessor paths (expand_mmac_params, detoken...

CVE-2018-20721

CVE-2018-20721 affects uriparser prior to 0.9.1, where URI_FUNC() in UriParse.c and the uriParseEx routines mishandle an incomplete IPv6 URI containing an embedded IPv4 address (example: //[::44.1). This triggers an out-of-bounds read in the parsing flow. The description indicates the issue is in...

CVE-2018-6056

CVE-2018-6056 : A type confusion in Google Chrome’s V8 JavaScript engine could cause a heap out-of-bounds write, enabling remote arbitrary code execution inside the sandbox via a crafted HTML page. Affected: Chrome with V8 up to version prior to 64.0.3282.168. Remediation : upgrade to Chrome 64.0...

CVE-2018-6089

Google Chrome/Chromium prior to 66.0.3359.117 was affected by CVE-2018-6089, a Same Origin Policy bypass in Service Workers triggered by a cross-origin PDF redirect after a Safari-like CORS gap. The workaround is upgrading to 66.0.3359.117 or newer; Chrome’s 66 stable release notes confirm the fi...

CVE-2020-16292

Ghostscript v9.50 contains a buffer overflow in mj_raster_cmd() (contrib/japanese/gdevmjc.c) that can be triggered by processing a crafted PDF, allowing a remote attacker to cause a denial of service. The issue is fixed in Ghostscript v9.51. Affected product: Artifex Ghostscript; vulnerable compo...

CVE-2020-29074

CVE-2020-29074 affects x11vnc 0.9.16 where scan.c uses IPC_CREAT|0777 in shmget, enabling access by other users. Connected advisories (Fedora, Debian) confirm this vulnerability and reference x11vnc as the affected component. CVSS details show high impact (C/H/I/A) with network exposure and low a...

CVE-2021-4068

The CVE-2021-4068 entry applies to Chromium’s new tab page. The connected documents confirm an insufficient validation vulnerability in the new tab page component of the Chromium browser engine prior to version 96.0.4664.93, enabling a remote attacker to leak cross-origin data via crafted HTML pa...

CVE-2021-46141

CVE-2021-46141 affects uriparser prior to 0.9.6, with invalid free operations in uriFreeUriMembers and uriMakeOwner. Multiple advisories (Debian, Fedora, ALAS) indicate potential DoS or arbitrary code execution, mitigated by upgrading to 0.9.6 or later; some advisories specify version updates (e....

CVE-2022-23481

CVE-2022-23481 affects xrdp prior to version 0.9.21, due to an out-of-bounds read in the function xrdp_caps_process_confirm_active(). The issue is fixed in later releases (e.g., 0.9.21 and subsequent distro patches such as 0.9.21.1-1~deb11u1 and Fedora/Alt/Linux updates). Impact is described as h...

CVE-2022-26661

CVE-2022-26661 is an XXE vulnerability in Tryton Application Platform (Server) and its proteus CLI client. The issue allows an authenticated user to have the server parse a crafted XML SEPA file to access arbitrary files on the system. Affected families include Tryton Server (5.x up to 5.0.45; 6....

CVE-2022-30786

CVE-2022-30786 affects NTFS-3G via a heap-based buffer overflow in ntfs_names_full_collate (through 2021.8.22). Connected advisories confirm the issue across multiple vendors/distros and show patched versions or fixes (examples: Debian/DSA and AlmaLinux entries; Mariner advisory notes upgrade to ...

CVE-2022-47951

CVE-2022-47951 affects OpenStack components (Cinder, Glance, Nova): by supplying a specially crafted VMDK flat image referencing a backing file path, an authenticated user could cause the server to return the contents of that backing file, enabling unauthorized data access. Affected ranges: Cinde...

CVE-2023-24021

CVE-2023-24021 affects ModSecurity’s handling of file uploads via the FILES_TMP_CONTENT collection, due to incorrect handling of '\0' bytes. The vulnerability can enable Web Application Firewall bypasses and buffer over-reads on the WAF when rules read FILES_TMP_CONTENT. Affected product: ModSecu...

CVE-2023-52935

CVE-2023-52935 refers to a Linux kernel vulnerability in mm/khugepaged related to an ->anon_vma race when removing page tables. The issue could allow concurrent access to page tables during rmap traversal if an anon_vma is shared; the fix adds a re-check after acquiring the mmap lock so there ...

CVE-2025-37810

CVE-2025-37810 refers to a Linux kernel issue in the usb: dwc3 gadget path where the event count check did not validate that the count did not exceed the event buffer length. The problem could allow an out-of-bounds memcpy of an event if the count is larger than the buffer, leading to a crash (ke...

CVE-2025-37885

CVE-2025-37885 affects the Linux kernel KVM/x86, where a dangling IRTE could be left posting to a vCPU if the new GSI route cannot be posted. The issue is fixed by restoring IRTE ownership to the host control when the new route isn’t postable, preventing use-after-free and incorrect interrupt del...

CVE-2014-1557

CVE-2014-1557 : In Mozilla Firefox (and related Mozilla products), the ConvolveHorizontally function in Skia mishandles discarding image data during scaling, allowing remote code execution via a crafted high‑quality image. Affected versions include Firefox before 31.0, Firefox ESR 24.x before 24....

CVE-2015-0501

CVE-2015-0501 is a MySQL Server vulnerability affecting 5.5.42 and earlier and 5.6.23 and earlier, where an unspecified issue in Server: Compiling could allow a remote authenticated user to disrupt availability. The connected documents confirm that exploitation details are not provided, and the a...

CVE-2015-4802

Technical details about CVE-2015-4802 are not publicly provided in the supplied documents. Monitor for updates from vendor advisories and security databases to obtain explicit affected versions, impact, and remediation.

CVE-2015-4836

CVE-2015-4836 is an unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allowing remote authenticated users to affect availability via unknown vectors related to Server : SP. Affected products/versions are Oracle MySQL Server 5.5.x (<=5.5.45) and 5.6.x (

CVE-2016-2037

CVE-2016-2037 affects the cpio utility (cpio 2.11) via the cpio_safer_name_suffix function in util.c, enabling an attacker to cause an out-of-bounds write through a crafted cpio file, resulting in a denial of service. Related entries note additional issues (e.g., CVE-2021-38185) in GNU cpio, incl...

CVE-2016-5584

CVE-2016-5584 is an unspecified vulnerability in Oracle MySQL that could affect confidentiality via encryption-related vectors in Server: Encryption. Affected products/versions listed include MySQL 5.5.52 and earlier, 5.6.33 and earlier, and 5.7.15 and earlier. Connected documents confirm this CV...

CVE-2016-8909

CVE-2016-8909 is an issue in QEMU’s Intel High Definition Audio emulation. The vulnerability exists in the intel_hda_xfer function (hw/audio/intel-hda.c) where an entry with the same value for buffer length and pointer position can be supplied by a local attacker (local guest OS administrator), l...

CVE-2017-5470

CVE-2017-5470 involves memory safety bugs reported in Firefox 53 and Firefox ESR 52.1, with memory corruption evidence that could enable arbitrary code execution. The entry covers affected versions Firefox < 54, Firefox ESR < 52.2, and Thunderbird

CVE-2017-8354

Technical details about CVE-2017-8354 are not provided in the connected documents. The initial description notes a memory-leak issue in ImageMagick ReadBMPImage (7.0.5-5) but no vendor/version specifics or fixes are included here. Monitor for updates.

CVE-2018-12374

Mozilla Thunderbird before 52.9.1 is affected by multiple issues (CVE-2018-5188, CVE-2018-12359 through CVE-2018-12374) including information disclosure and memory safety bugs. The specific CVE-2018-12374 vulnerability allows plaintext of decrypted emails to leak when a user submits an embedded f...

CVE-2018-16645

CVE-2018-16645: ImageMagick 7.0.8-11 is affected by an excessive memory allocation in ReadBMPImage (coders/bmp.c) and ReadDIBImage (coders/dib.c). This memory allocation may be triggered by processing a crafted BMP/DIB image, allowing remote attackers to cause a denial of service. The Initial doc...

CVE-2018-18344

CVE-2018-18344 affects Google Chrome/Chromium before 71.0.3578.80 where the setDownloadBehavior devtools protocol feature in Extensions could be abused by a remote attacker who controls an installed extension to access local files. The issue is described as an inappropriate implementation in the ...

CVE-2018-6071

CVE-2018-6071 is a heap/buffer overflow in Skia used by Google Chrome (pre-65.0.3325.146). Connected sources confirm a Skia-related overflow that could trigger an out-of-bounds memory access via a crafted HTML page. Affected context appears in Chrome/Chromium release notes and Debian/Gentoo advis...

CVE-2018-6141

Summary: Google Chrome's Skia image filter had insufficient validation that could allow a remote attacker with renderer access to perform an out-of-bounds memory read via a crafted HTML page. Affected versions are before 67.0.3396.62; the issue is resolved in 67.0.3396.62+.

CVE-2019-10064

CVE-2019-10064 affects hostapd prior to 2.6 in EAP mode, where rand() and random() are invoked without a preceding srand()/srandom(), leading to deterministic values. This behavior is described as an inappropriate use of randomness and is fixed in conjunction with CVE-2016-10743. Public reference...

CVE-2019-11010

GraphicsMagick 1.4 snapshot-20190322 Q8 is affected by CVE-2019-11010 due to a memory leak in ReadMPCImage (coders/mpc.c), enabling denial of service via a crafted image. Public records in multiple advisories confirm this issue alongside related CVEs (e.g., 11005–11009, 11473–11474) affecting SVG...