CVE-2011-0997

CVE-2011-0997 affects ISC DHCP dhclient across multiple releases (3.0.x–4.2.x before 4.2.1-P1; 3.1-ESV before 3.1-ESV-R1; 4.1-ESV before 4.1-ESV-R2). The vulnerability arises from insufficient sanitization of certain DHCP options (notably hostname) in server responses, enabling remote attackers t...

CVE-2014-1524

CVE-2014-1524 is reported in several Nessus entries tied to Mozilla Firefox components. Affected: Mozilla Firefox (before 29.0), Firefox ESR 24.x (before 24.5), Thunderbird (before 24.5), and SeaMonkey (before 2.26). Root cause: nsXBLProtoImpl::InstallImplementation does not reliably verify that ...

CVE-2014-6568

CVE-2014-6568 is an Oracle MySQL/MariaDB vulnerability affecting InnoDB DML leading to potential availability impact in MySQL Server 5.5.x (<=5.5.40) and 5.6.x (

CVE-2015-1779

CVE-2015-1779 affects QEMU with the VNC websocket frame decoder. The issue allows a remote attacker to cause a denial of service by sending oversized websocket payloads or HTTP headers, exhausting CPU and memory. Impact is observed when an attacker accesses a guest’s VNC console over the network....

CVE-2015-5296

CVE-2015-5296 affects Samba 3.x and 4.x (before 4.1.22, 4.2.x before 4.2.7, 4.3.x before 4.3.3). The root cause is that signing is not negotiated for encrypted client connections, enabling a man-in-the-middle downgrade to an unsigned (plaintext) data stream. This is related to code paths clidfs.c...

CVE-2015-5707

CVE-2015-5707 affects the Linux kernel sg.c sg_start_req function (drivers/scsi/sg.c) where an integer overflow can occur in write requests with a large iov_count, allowing a local attacker to cause a denial of service or potentially other impact on kernel memory. Affected are kernel versions 2.6...

CVE-2015-7500

CVE-2015-7500 affects libxml2’s xmlParseMisc in parser.c; an out-of-bounds heap read via improper entity boundaries could cause a DoS. A patch/update to libxml2 2.9.3 or later is recommended. (Mode C: details are supported by connected references indicating libxml2 impact.)

CVE-2015-8778

CVE-2015-8778 affects the GNU C Library (glibc) prior to 2.23, where an integer/size argument in hcreate_r can trigger an out-of-bounds heap access, potentially causing denial of service or arbitrary code execution. Connected advisories detail that multiple products (notably glibc-containing pack...

CVE-2016-4428

OpenStack Horizon (Dashboard) is affected by an XSS vulnerability (CVE-2016-4428) present in Horizon 8.0.1 and earlier and 9.0.0–9.0.1. The issue arises from injecting an AngularJS template into a dashboard form, allowing a remote authenticated user to inject arbitrary script/HTML. Impact reporte...

CVE-2016-9066

CVE-2016-9066 is a Mozilla Firefox-related issue. IBM notes it as a buffer/ memory-safety problem in Firefox shipped with IBM SONAS; root cause described as a buffer overflow due to an integer overflow in nsScriptLoadHandler. Affected products include Thunderbird <45.5, Firefox ESR <45.5, a...

CVE-2017-14107

CVE-2017-14107 affects libzip’s zip_open.c _zip_read_eocd64 logic prior to version 1.3.0. A crafted ZIP archive can trigger a denial of service via memory allocation failure in _zip_cdir_grow in zip_dirent.c. Several connected sources confirm this issue and indicate the fix is to upgrade to libzi...

CVE-2017-5205

tcpdump (before 4.9.0) contains a buffer overflow in the ISAKMP parser function print-isakmp.c:ikev2_e_print(), allowing a remote attacker to achieve arbitrary code execution by sending crafted network traffic. The entry CVE-2017-5205 is documented across multiple sources (e.g., Debian/ArchLinux ...

CVE-2018-16068

CVE-2018-16068 concerns a missing validation in Mojo within Google Chrome before 69.0.3497.81, which could allow a remote attacker to perform a sandbox escape via a crafted HTML page. The vulnerability is tied to the Mojo component in Chrome’s architecture and is addressed in Chromium/Chrome upda...

CVE-2018-17963

CVE-2018-17963 affects QEMU’s net/iov path. The vulnerability is introduced by qemu_deliver_packet_iov in net/net.c, which accepts packet sizes greater than INT_MAX, enabling a remote attacker to trigger a denial of service (and potentially other unspecified impact) by sending oversized packets. ...

CVE-2018-18341

CVE-2018-18341 affects Chromium/Google Chrome prior to 71.0.3578.80. The Blink/WebKit component contains a heap-based buffer overflow that could allow a remote attacker to exploit heap corruption via a crafted HTML page. Impact is remote code execution potential as part of heap corruption; exploi...

CVE-2018-18342

Chromium before version 71.0.3578.80 is affected by CVE-2018-18342 (and related CVEs listed in ASA-201812-2). The vulnerability for CVE-2018-18342 is an out-of-bounds write in the V8 JavaScript engine, enabling a remote attacker to execute arbitrary code inside the Chrome sandbox via a crafted HT...

CVE-2019-16394

SPIP (website engine) versions affected: 3.1.x prior to 3.1.11 and 3.2.x prior to 3.2.5. The issue is in the password reminder flow, where error messages differ depending on whether the provided e-mail exists, enabling potential user enumeration of subscribers. Root cause: non-homogeneous handlin...

CVE-2019-18978

CVE-2019-18978 (rack-cors) affects the Rack CORS Middleware for Ruby, prior to v1.0.4. The issue is improper canonicalization of pathnames, allowing directory traversal ("../") to access private resources. In public disclosures, Debian/Ubuntu advisories and OSS security plugins reference this vul...

CVE-2019-6256

LIVE555 Media Server libraries (liblivemedia) are affected by CVE-2019-6256. RTSP-over-HTTP tunneling enabled on liblivemedia servers can trigger an invalid function pointer dereference during error handling when two requests (GET and POST) with identical x-sessioncookie are sent in the same TCP ...

CVE-2020-14403

Vulnerability CVE-2020-14403 affects LibVNCServer prior to 0.9.13. The issue is in libvncserver/hextile.c and allows out-of-bounds access via encodings. No exploitation details are provided in the sources beyond this description. Mitigation is to upgrade LibVNCServer to 0.9.13 or later (or apply ...

CVE-2020-16299

Ghostscript vulnerability CVE-2020-16299: A Division by Zero in bj10v_print_page() (contrib/japanese/gdev10v.c) of Artifex Ghostscript v9.50 can cause a denial of service via a crafted PDF. Affects Ghostscript 9.50; fixed in v9.51. Remediation is to upgrade to 9.51 or later. No exploit details ar...

CVE-2020-9359

Summary: CVE-2020-9359 affects KDE Okular prior to 1.10.0, enabling code execution through specially crafted PDF action links. Multiple advisories confirm local/remote code execution potential depending on the vendor and version. Impact notes (per sources): CentOS/Red Hat mentions local binary ex...

CVE-2020-9497

Apache Guacamole up to version 1.1.0 is affected by CVE-2020-9497 due to improper validation of data from RDP servers via static virtual channels, potentially allowing disclosure of memory in the guacd process when connecting to a malicious or compromised RDP server. Connected sources also refere...

CVE-2021-21219

CVE-2021-21219 concerns uninitialized data in PDFium used by Google Chrome prior to 90.0.4430.72, enabling a remote attacker to glean potentially sensitive information from process memory via a crafted PDF. The connected documents corroborate this information-disclosure impact via PDFium across C...

CVE-2021-37969

CVE-2021-37969 affects Google Chrome/Chromium components on Windows prior to 94.0.4606.54 due to an inappropriate implementation in Google Updater, enabling local privilege escalation via a crafted file. Remediation is to update to a patched version; Chrome/Chromium updates have been released (e....

CVE-2021-46829

GNOME GdkPixbuf (GIF decoding path) is affected by a heap-based buffer overflow in frames during GIF compositing/clearing, exploitable via io-gif-animation.c composite_frame. Root cause: overflow in GIF lzw/decode path, reported for versions before 2.42.8. Impact: potential arbitrary code executi...

CVE-2022-31090

CVE-2022-31090 affects Guzzle (PHP HTTP client): when using the Curl handler, a request following a redirect to a different origin can keep the CURLOPT_HTTPAUTH-injected Authorization header, enabling potential exposure of sensitive credentials. Root cause: the Authorization header is not cleared...

CVE-2022-32278

CVE-2022-32278 affects XFCE Exo (XFCE 4.16) where xdg-open can execute a .desktop file hosted on an attacker-controlled FTP server, enabling arbitrary code execution. Root cause: insecure handling of .desktop files in remote sources. Affected component: exo (XFCE library). Impact: remote code exe...

CVE-2023-38633

CVE-2023-38633 relates to a directory traversal in the URL decoder of librsvg up to version 2.56.3. The vulnerability could allow local or remote attackers to disclose files on the local filesystem outside the intended area, demonstrated via href=".?../../../../../../../../../../etc/passwd" in an...

CVE-2024-27417

CVE-2024-27417 affects the Linux kernel IPv6 path inet6_rtm_getaddr, where if userspace provides a correct IFA_TARGET_NETNSID but omits IFA_ADDRESS and IFA_LOCAL, the function could return -EINVAL while leaking an elevated net namespace reference. The issue is described as a potential 4net leak...

CVE-2025-38004

The CVE-2025-38004 entry affects the Linux kernel CAN BCM subsystem. A race allowed by updates to the currframe/count in bcm_can_tx() could enable user-space-triggered modifications from hrtimer context, leading to a KASAN slab-out-of-bounds read. The patch fixes by moving the count variable into...

CVE-2025-38083

In CVE-2025-38083, the Linux kernel net_sched/prio package has a race in prio_tune() that can underflow a parent qlen when the SFQ perturb timer fires at the wrong time. The race involves CPU0 holding a root lock while CPU1 performs rehash and backlog reduction, with qdisc_put() interplay. The ad...

CVE-2012-0442

CVE-2012-0442 covers multiple memory-safety vulnerabilities in the Mozilla browser engine affecting Firefox before 3.6.26 and 4.x–9.0, Thunderbird before 3.1.18 and 5.0–9.0, and SeaMonkey before 2.7. The issues can cause memory corruption, application crashes, or potentially remote code execution...

CVE-2012-3515

CVE-2012-3515 affects QEMU (as used in Xen 4.0/4.1) where emulating certain devices with a virtual console backend lets local guest OS users gain privileges via a crafted escape VT100 sequence that overwrites a device model’s address space. Connected documents confirm this CVE is included in mult...

CVE-2012-3986

CVE-2012-3986 affects Mozilla Firefox prior to 16.0 (and Firefox ESR 10.x prior to 10.0.8), Thunderbird prior to 16.0, and SeaMonkey before 2.13. The root cause is that certain DOMWindowUtils (nsDOMWindowUtils) methods were not protected by security checks, allowing remote JavaScript to bypass in...

CVE-2013-0155

CVE-2013-0155 affects Ruby on Rails, specifically Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11. The vulnerability arises from mismatched parameter handling between Active Record and the JSON implementation, allowing remote attackers to bypass database-query restrictions...

CVE-2013-4242

CVE-2013-4242 affects GnuPG before 1.4.14 and Libgcrypt before 1.5.3 (as used in GnuPG 2.0.x), enabling a local user to obtain private RSA keys via a cache side-channel (Flush+Reload) on the L3 cache. The root cause is a cache side-channel leak in the RSA key handling within GnuPG/Libgcrypt. Docu...

CVE-2014-9015

CVE-2014-9015 affects Drupal 6.x before 6.34 and Drupal 7.x before 7.34. A crafted request (to a server handling both HTTP and HTTPS) can hijack an active user session. The vulnerability stems from how sessions are managed in these versions, enabling an attacker to take over another user’s sessio...

CVE-2015-4752

CVE-2015-4752 affects Oracle MySQL Server, specifically the Server : I_S component, with vulnerable versions 5.5.43 and earlier and 5.6.24 and earlier. Reports describe an unspecified vulnerability that remote authenticated users can trigger over the network to cause a denial of service, with the...

CVE-2016-0644

CVE-2016-0644 is an unspecified local-vulnerability in Oracle MySQL/MariaDB affecting DDL paths that can impact availability. Public HOTFIXes exist: MariaDB 10.0.25 (per Debian DSA-3595-1) and MariaDB 5.5.50 (per CentOS CentOS-announce 2016:1602). IBM/PowerKVM advisories also reference this CVE w...

CVE-2016-1669

The vulnerability CVE-2016-1669 affects Google V8’s Zone::New in zone.cc, with V8 versions before 5.0.71.47 used by Google Chrome older than 50.0.2661.102. A mis-timed expansion of memory allocations can allow a remote attacker to trigger a buffer overflow, causing denial of service and potential...

CVE-2016-9190

Pillow (Python Imaging Library) prior to version 3.3.2 is affected by CVE-2016-9190. The bug arises from an Insecure Sign Extension issue in ImagingNew within Storage.c, enabling context-dependent attackers to achieve arbitrary code execution via a crafted image file. Affected versions are Pillow...

CVE-2017-17480

OpenJPEG 2.3.0 contains a stack-based buffer overflow in the pgxtovolume function (jp3d/convert.c). The out-of-bounds write can enable remote denial of service or possibly remote code execution. Publicly documented remediation in connected advisories includes updates/patches: Debian DSA-4405-1 fi...

CVE-2018-1000544

CVE-2018-1000544 affects the rubyzip gem (versions up to and including 1.2.1). It enables a Directory Traversal in Zip::File that can write arbitrary files to the filesystem when processing crafted ZIPs (e.g., using symlinks or absolute paths). Public advisories (e.g., Debian DLA-2307-1, RH advis...

CVE-2018-16542

CVE-2018-16542 affects Artifex Ghostscript prior to 9.24. An attacker could craft PostScript to trigger insufficient interpreter stack-size checking during error handling, potentially crashing the Ghostscript interpreter (denial of service). Some connected sources also describe a stack-based out-...

CVE-2018-18351

CVE-2018-18351 is a Chromium/Google Chrome vulnerability described in connected sources as an access restriction bypass in the Navigation component, caused by insufficient policy enforcement that allows bypassing the SameSite cookie policy via a crafted HTML page. Affected product: Chromium/Chrom...

CVE-2018-19199

CVE-2018-19199 affects uriparser before 0.9.0. UriQuery.c allows an integer overflow via uriComposeQuery* or uriComposeQueryEx* due to an unchecked multiplication; CVE-2018-19198 covers an out-of-bounds write via the same functions because of mishandling of '&'. Multiple advisories (Ubuntu USN-51...

CVE-2018-6124

CVE-2018-6124 is a type confusion vulnerability in Blink ReadableStreams in Google Chrome (Chromium) prior to 67.0.3396.62. The underlying issue is a type confusion in Blink’s ReadableStreams, allowing a remote attacker to potentially cause object corruption via a crafted HTML page. Affected soft...

CVE-2019-13455

Xymon is affected by CVE-2019-13455:

CVE-2020-22049

CVE-2020-22049 is a Denial of Service vulnerability in FFmpeg 4.2 caused by a memory leak in wtvfile_open_sector() (wtvdec.c). Exploitation could lead to a DoS via resource exhaustion. The connected documents (Debian, SUSE/openSUSE, Astra Linux advisories) confirm FFmpeg 4.2 is affected and list ...