CVE-2021-38021

CVE-2021-38021 affects the Chromium engine used by Google Chrome/Chromium. The issue is an inappropriate implementation in the referrer handling component, before version 96.0.4664.45, which can allow a remote attacker to bypass navigation restrictions via a crafted HTML page, potentially leading...

CVE-2022-33745

The CVE-2022-33745 issue is in the Xen hypervisor affecting x86 paravirtualized guests. The root cause is an incorrect TLB flush condition after code movement inside Xen, causing some necessary TLB flushes to be omitted when running PV guests in shadow paging mode (to support migrations and L1TF ...

CVE-2025-37850

The CVE-2025-37850 issue relates to the Linux kernel PWM Mediatek driver. Under CONFIG_COMPILE_TEST && !CONFIG_HAVE_CLK, pwm_mediatek_config() could divide by zero when obtaining the clock rate for pc->clk_pwms[pwm->hwpwm], because clk_get_rate() may return zero in the !CONFIG_HAVE_CLK path...

CVE-2005-1513

CVE-2005-1513 is a known vulnerability in netqmail (qmail) involving an integer overflow in the stralloc_readyplus function when run on 64-bit platforms with large memory. This can allow a remote attacker to cause a denial of service and potentially execute arbitrary code via a large SMTP request...

CVE-2008-4360

Vulnerability summary (CVE-2008-4360) Lighttpd

CVE-2009-5049

CVE-2009-5049 affects Jetty, specifically the WebApp JSP Snoop page in Jetty 6.1.21. The vulnerability arises from improper validation of user-supplied input in the WebApp JSP Snoop page, enabling cross-site scripting (XSS). The connected sources consistently describe a WebApp JSP Snoop page XSS ...

CVE-2011-4968

CVE-2011-4968 concerns the nginx http proxy module failing to verify the peer identity of the HTTPS origin server, enabling potential MITM attacks. The vulnerability is described as an information-security issue in the nginx proxy component where TLS peer verification is not performed for upstrea...

CVE-2013-3839

CVE-2013-3839 affects MySQL/MariaDB: remote authenticated users could affect availability via the Optimizer in Oracle MySQL Server 5.1.70 and earlier, 5.5.32 and earlier, and 5.6.12 and earlier. Connected advisories (RHSA-2014:0189; CentOS/CESA entries) document the impact across affected MariaDB...

CVE-2014-6055

CVE-2014-6055 is a LibVNCServer (rfbserver.c) vulnerability: multiple stack-based buffer overflows in the File Transfer feature could allow remote authenticated users to crash the server and potentially execute arbitrary code. Affected product/version reference in the sources includes LibVNCServe...

CVE-2015-0374

CVE-2015-0374 is a MySQL/MariaDB server vulnerability impacting confidentiality via unknown vectors in Foreign Key handling. Affected products and versions include Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier (and MariaDB/forked releases in corresponding lines). Public advisories...

CVE-2015-0499

CVE-2015-0499 is a documented, non-query vulnerability in Oracle MySQL Server 5.5.42 and earlier and 5.6.23 and earlier, affecting the Server Federated component and capable of denial of service by remote authenticated users. Public details confirm the issue but do not provide exploit specifics. ...

CVE-2015-4826

CVE-2015-4826 affects Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier. The vulnerability is described as unspecified and allows remote authenticated users to affect confidentiality via unknown vectors related to Server: Types. The NVD entry lists a CVSS2 base score of 4.0 (MEDIUM) w...

CVE-2016-0640

CVE-2016-0640 is an unspecified MySQL/MariaDB server vulnerability affecting DML operations with partial integrity/availability impact. Public notices in 2016 (Debian DSA-3595, CentOS/CentOS-announce, Red Hat advisories) show fixes across MariaDB/MySQL branches (e.g., MariaDB 10.0.x and MySQL 5.5...

CVE-2016-1683

CVE-2016-1683 affects libxslt prior to 1.1.29, as used in Google Chrome before 51.0.2704.63. The issue arises from numbers.c in libxslt, where namespace nodes are mishandled, enabling a remote attacker to trigger out-of-bounds heap memory access and cause a denial of service (with potential unspe...

CVE-2016-1838

CVE-2016-1838 refers to a vulnerability in libxml2 where the xmlPArserPrintFileContextInternal function can be exploited by a crafted XML document to cause a heap-based overflow/read, leading to a denial of service or potential escalation. The initial description notes the issue affects libxml2 u...

CVE-2016-2822

Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 are vulnerable to address-bar spoofing. The issue arises from a persistent menu in a SELECT element that can overlay the URL bar, allowing remote attackers to masquerade a malicious site as trusted. Affected products include Firefox des...

CVE-2016-9189

CVE-2016-9189 concerns Pillow (Python Imaging Library fork). Affected: Pillow versions before 3.3.2. Root cause: integer overflow in Image.core.map_buffer within map.c that can be exploited via crafted image files. Impact: information disclosure (partial confidentiality) per CVSS data; local expl...

CVE-2017-12181

CVE-2017-12181 affects the X.Org X server (xorg-x11-server) prior to version 1.19.5. The vulnerability arises from missing length validation in the XFree86 DGA extension, which can cause the X server to crash and potentially allow arbitrary code execution by a malicious X client. Public documents...

CVE-2017-12379

CVE-2017-12379 affects ClamAV up to version 0.99.2, due to improper input validation in the message parsing function. A remote attacker can send a crafted email to trigger a messageAddArgument buffer overflow in message.c, potentially causing DoS or executing arbitrary code on the affected device...

CVE-2018-10999

CVE-2018-10999 affects Exiv2 0.26. The Exiv2::Internal::PngChunk::parseTXTChunk function is susceptible to a heap-based buffer over-read. The connected documents corroborate the issue's association with Exiv2 and the vulnerability class, but do not specify a patched version or exact remediation w...

CVE-2018-6034

CVE-2018-6034 originates from an integer overflow in Blink/WebGL leading to an out-of-bounds memory read in Google Chrome before version 64.0.3282.119. The Initial description states the vulnerability as an insufficient data validation in WebGL causing the out-of-bounds read via a crafted HTML pa...

CVE-2018-6096

CVE-2018-6096 is a Fullscreen UI spoof vulnerability in Google Chrome/Chromium where a JavaScript window could overlap the fullscreen notification, enabling a remote attacker to obscure the fullscreen warning via a crafted HTML page. Public details confirm the issue affects Chromium/Chrome prior ...

CVE-2018-6137

CVE-2018-6137 is a Blink information-leak vulnerability in Google Chrome, present in Blink-based builds prior to 67.0.3396.62. A crafted HTML page could allow a remote attacker to disclose cross-origin data. Connected CNVD-2018-11487 describes the Chrome/Blink impact and mode of disclosure. Publi...

CVE-2018-6139

CVE-2018-6139 affects Google Chrome/Chromium’s debugger extension API in DevTools, before 67.0.3396.62. An attacker convincing a user to install a malicious extension could bypass restrictions and execute arbitrary code. Public exploits exist. Remediation: upgrade to 67.0.3396.62 or newer. Affect...

CVE-2019-14369

CVE-2019-14369 : Exiv2 0.27.99.0’s PngImage::readMetadata() (pngimage.cpp) allows a crafted PNG image to trigger a heap-based buffer over-read, leading to a denial of service. Public documents corroborate this impact and indicate fixes in Exiv2 release 0.27.4 (and related patches in downstream di...

CVE-2019-16392

SPIP vulnerability CVE-2019-16392 affects SPIP prior to 3.1.11 and 3.2 prior to 3.2.5. The issue is a cross-site scripting (XSS) through error messages exposed by login.php, allowing a remote attacker to trigger script execution via crafted input. The impact is described in CVSS terms as medium s...

CVE-2020-10729

CVE-2020-10729 describes a vulnerability in Ansible where insufficiently random values cause two password lookups of the same length to produce identical results during template caching, potentially exposing all passwords for a file. Affected: Ansible Engine versions before 2.9.6. Root cause: re-...

CVE-2021-21289

CVE-2021-21289 affects Mechanize (Ruby library) from v2.0.0 up to v2.7.7, where a command-injection vulnerability exists. The flaw arises because several methods (CookieJar#load, CookieJar#save_as, Mechanize#download, Mechanize::Download#save, Mechanize::File#save, Mechanize::FileResponse#read_bo...

CVE-2021-4056

CVE-2021-4056 is a type-confusion vulnerability in the loader component of the Chromium browser engine, present in Chrome/Chromium prior to version 96.0.4664.93. A remote attacker could potentially cause arbitrary code execution through a crafted HTML page, as described in multiple vendor advisor...

CVE-2022-23527

CVE-2022-23527 affects mod_auth_openidc for Apache 2.x. Versions prior to 2.4.12.2 are vulnerable to an Open Redirect caused by improper validation in oidc_validate_redirect_url() for logout redirect URIs that may start with a tab (\t). The issue can be mitigated by upgrading to 2.4.12.2; if upgr...

CVE-2022-33744

CVE-2022-33744 is an ARM Xen guest vulnerability where unprivileged guests can provoke a Denial of Service in Dom0 via paravirtual devices. The root cause is a race window in updating an rbtree that tracks guest mappings when mapping guest pages on ARM, potentially crashing Dom0 or blocking furth...

CVE-2022-44730

CVE-2022-44730 is a Server-Side Request Forgery (SSRF) in Apache XML Graphics Batik (affected version: 1.16). A malicious SVG can probe user data and send it as a parameter to a URL; advisories (IBM bulletin, ALAS-2025-2801, Amazon Linux advisories) identify this alongside CVE-2022-44729 and reco...

CVE-2023-2463

CVE-2023-2463 : In Google Chrome (Android), an inappropriate implementation in Full Screen Mode could allow a remote attacker to hide the contents of the Omnibox (URL bar) via a crafted HTML page. Affected software is Chrome/Chromium family, with the issue linked to Full Screen handling. The vuln...

CVE-2023-51714

The CVE-2023-51714 entry concerns Qt’s HTTP/2 HPack handling: an incorrect HPack integer overflow check in network/access/http2/hpacktable.cpp affects Qt base components. Affected are Qt before 5.15.17, 6.x before 6.2.11, 6.3.x–6.5.x before 6.5.4, and 6.6.x before 6.6.2. The issue’s impact is des...

CVE-2023-6864

CVE-2023-6864 affects Mozilla Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. The issue is described as memory safety bugs with evidence of memory corruption; with sufficient effort these could be exploited to execute arbitrary code. Impact is high (CVE base score 8.8; confidentiality, int...

CVE-2024-26736

CVE-2024-26736 (Linux kernel afs): A local vulnerability in afs_update_volume_status() where volume->vid is limited to 20 characters, risking a buffer overflow. The fix increases idbuf size from 20 to 24 and uses snprintf to prevent overflow. Affected: Linux kernel (afs subsystem). Reported by...

CVE-2024-26752

CVE-2024-26752 affects the Linux kernel L2TP/IP6 path: a miscalculated ulen in l2tp_ip6_sendmsg (ulen = len + skb_queue_empty(...) ? transhdrlen : 0) due to operator precedence caused incorrect transport-header accounting, leading to corrupted packets on the wire. The fix adds parentheses to alig...

CVE-2024-26805

CVE-2024-26805 (Linux kernel) fixed a kernel-infoleak-after-free in netlink path. The issue occurred in __skb_datagram_iter via netlink_to_full_skb, where len was computed from skb->end (buffer offset) instead of skb->len (actual data length), causing uninit memory to be copied. The patch c...

CVE-2024-43839

CVE-2024-43839 : Linux kernel vulnerability fixed by increasing the internal name buffer in bna_tcb and bna_ccb from 16 to accommodate longer sprintf arguments, and replacing sprintf with snprintf. The change accounts for bnad->netdev->name and expected expansions for %d specifiers, using B...

CVE-2025-22119

CVE-2025-22119 concerns the Linux kernel wireless stack. The issue occurs in cfg80211 where wiphy_work is not fully initialized before rfkill allocation, allowing cfg80211_dev_free to access uninitialized wiphy_work data via a race with the rfkill path. The root cause is an uninitialized wiphy_wo...

CVE-2025-37768

The CVE-2025-37768 entry concerns the Linux kernel DRM-AMD PM component. Public docs confirm the vulnerability is in drm/amd/pm: a division by zero can occur when the user sets a speed value greater than UINT_MAX/8, allowing a local attacker to trigger a crash. The issue has been resolved in the ...

CVE-2025-37771

CVE-2025-37771 affects the Linux kernel (drm/amd/pm) with a division-by-zero flaw when the user sets a speed value greater than UINT_MAX/8. It is a local vulnerability; kernel fixes are referenced in upstream commits (e.g., 6413fed016208171592c88b5df002af8a1387e24 and related edits). The issue ha...

CVE-2025-37781

CVE-2025-37781 affects the Linux kernel involving the i2c Cros EC tunnel. When i2c-cros-ec-tunnel and the EC driver are built-in, the EC parent device may not be found, causing a NULL pointer dereference. The issue can be reproduced by unbinding the controller driver and re-loading the i2c-cros-e...

CVE-2025-37998

CVE-2025-37998 concerns openvswitch in the Linux kernel where unsafe Netlink attribute parsing in output_userspace() could lead to processing of malformed attributes. The connected documents confirm a patch that replaces the manual Netlink attribute iteration in output_userspace() with nla_for_ea...

CVE-2013-0780

CVE-2013-0780 is a use-after-free vulnerability in Mozilla Firefox related to the nsOverflowContinuationTracker::Finish function. It affects Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16. An attacker c...

CVE-2015-2739

CVE-2015-2739 affects Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1. The issue is in ArrayBufferBuilder::append, which accesses unintended memory locations. The description notes unspecified impact and attack vectors; no explicit explo...

CVE-2016-10894

The CVE-2016-10894 issue affects xtrlock up to version 2.10, where multitouch input is not blocked. An attacker at a locked screen can inject input to programs (e.g., Chromium) via multitouch events such as pan scrolling, pinch/zoom, or by issuing mouse clicks after depressing the touchpad with a...

CVE-2017-15130

CVE-2017-15130 affects Dovecot; a denial-of-service via TLS SNI config lookups occurs when an attacker can generate random SNI server names, causing excessive memory usage and possible restart. Affected are Dovecot versions before 2.2.34. Several advisories/plugins (SUSE/OpenSUSE, EulerOS, Debian...

CVE-2017-16532

CVE-2017-16532: A vulnerability in the Linux kernel ≤ 4.13.11 affects the get_endpoints function in drivers/usb/misc/usbtest.c, enabling local users to trigger a denial of service via a crafted USB device, through a NULL pointer dereference and potential system crash. The issue is triggered by a ...

CVE-2017-3648

CVE-2017-3648 affects the Oracle MySQL Server component (subcomponent: Charsets). MiracleLinux/Nessus entries show affected versions: 5.5.56 and earlier, 5.6.36 and earlier, and 5.7.18 and earlier. The vulnerability stems from the MySQL Server’s handling of chars/handshake, allowing a high-privil...