CVE-2015-0499

CVE-2015-0499 is a documented, non-query vulnerability in Oracle MySQL Server 5.5.42 and earlier and 5.6.23 and earlier, affecting the Server Federated component and capable of denial of service by remote authenticated users. Public details confirm the issue but do not provide exploit specifics. ...

CVE-2015-2739

CVE-2015-2739 affects Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1. The issue is in ArrayBufferBuilder::append, which accesses unintended memory locations. The description notes unspecified impact and attack vectors; no explicit explo...

CVE-2015-3165

CVE-2015-3165 is a PostgreSQL double-free remote-denial-of-service vulnerability. Affected: PostgreSQL versions pre-9.0.20, 9.1.x pre-9.1.16, 9.2.x pre-9.2.11, 9.3.x pre-9.3.7, and 9.4.x pre-9.4.2. Root cause: double-free during SSL session shutdown when the authentication timeout is expiring, al...

CVE-2015-4826

CVE-2015-4826 affects Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier. The vulnerability is described as unspecified and allows remote authenticated users to affect confidentiality via unknown vectors related to Server: Types. The NVD entry lists a CVSS2 base score of 4.0 (MEDIUM) w...

CVE-2016-10894

The CVE-2016-10894 issue affects xtrlock up to version 2.10, where multitouch input is not blocked. An attacker at a locked screen can inject input to programs (e.g., Chromium) via multitouch events such as pan scrolling, pinch/zoom, or by issuing mouse clicks after depressing the touchpad with a...

CVE-2016-1838

CVE-2016-1838 refers to a vulnerability in libxml2 where the xmlPArserPrintFileContextInternal function can be exploited by a crafted XML document to cause a heap-based overflow/read, leading to a denial of service or potential escalation. The initial description notes the issue affects libxml2 u...

CVE-2016-2822

Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 are vulnerable to address-bar spoofing. The issue arises from a persistent menu in a SELECT element that can overlay the URL bar, allowing remote attackers to masquerade a malicious site as trusted. Affected products include Firefox des...

CVE-2016-9911

CVE-2016-9911 (QEMU) : A memory leak vulnerability in QEMU built with USB EHCI emulation. The leak occurs while processing packet data in ehci_init_transfer, allowing a guest user/process to leak host memory and potentially cause a DoS on the host. The available connected documents confirm the pr...

CVE-2017-12184

CVE-2017-12184 affects the X.Org X server (xorg-x11-server) prior to version 1.19.5. The root cause is a missing length validation in the XINERAMA extension, which could allow a malicious X client to crash the X server or potentially execute arbitrary code. Public sources in the connected documen...

CVE-2017-15130

CVE-2017-15130 affects Dovecot; a denial-of-service via TLS SNI config lookups occurs when an attacker can generate random SNI server names, causing excessive memory usage and possible restart. Affected are Dovecot versions before 2.2.34. Several advisories/plugins (SUSE/OpenSUSE, EulerOS, Debian...

CVE-2017-5472

CVE-2017-5472 is a use-after-free in Mozilla's frameloader during CSS layout regeneration, leading to potential crash. Concrete details in connected docs show impact on Firefox versions <54, Firefox ESR <52.2, and Thunderbird

CVE-2017-6188

CVE-2017-6188 affects Munin prior to a fixed version where CGI graphs enabled allow a local file overwrite by abusing multiple upper_limit GET parameters. The vulnerability enables overwriting any file accessible to the webserver user (www-data). Public disclosures and advisories in connected doc...

CVE-2017-7751

CVE-2017-7751 is a use-after-free vulnerability in Mozilla Firefox and Thunderbird associated with content viewer listeners, affecting Firefox versions before 54, ESR before 52.2, and Thunderbird before 52.2. The underlying issue is a memory safety flaw that can lead to a potentially exploitable ...

CVE-2017-8365

CVE-2017-8365 affects libsndfile 1.0.28 where the i2les_array function in pcm.c can cause a global buffer overflow via a crafted audio file, leading to denial of service (buffer over-read and crash). Connected advisories (Debian, Gentoo, Fedora, Mariner) note a patched release is available and ur...

CVE-2018-17469

CVE-2018-17469 affects Google/Chromium’s PDFium component: a heap-based buffer overflow in PDFium prior to 70.0.3538.67 (in PDF filter chain handling) can enable a remote attacker to trigger out-of-bounds memory reads and potentially execute code. Public sources in connected docs confirm the issu...

CVE-2018-18349

CVE-2018-18349 affects Chromium/Chrome Blink prior to version 71.0.3578.80, where an insufficient policy enforcement in Blink allowed remote frame navigations to access local files via a crafted Chrome Extension. Connected advisories (Arch Linux ASA-201812-2, Debian DSA-4352-1, Debian DSA-4352-1:...

CVE-2018-2773

CVE-2018-2773 affects Oracle MySQL Server client programs (vulnerable in MySQL Server subcomponent client programs) and is cataloged in multiple advisories. Public data in connected documents confirms affected MySQL client/server packages, with vulnerable ranges including MySQL 5.5.59 and earlier...

CVE-2018-6066

CVE-2018-6066 affects Google Chrome (Blink) due to lack of CORS checking in ResourceFetcher/ResourceLoader, enabling a remote attacker to leak cross-origin data via crafted HTML. Publicly reported as a Same Origin Policy bypass in Chrome/Chromium before 65.0.3325.146; multiple vendors referenced ...

CVE-2018-6067

CVE-2018-6067 is a vulnerability in Google Chrome/Chromium where the Skia library contains a buffer/heap overflow issue. Affected component: Skia inside Chrome/Chromium prior to version 65.0.3325.146. Root cause: unspecified in the provided documents beyond “buffer overflow in the Skia library.” ...

CVE-2018-6096

CVE-2018-6096 is a Fullscreen UI spoof vulnerability in Google Chrome/Chromium where a JavaScript window could overlap the fullscreen notification, enabling a remote attacker to obscure the fullscreen warning via a crafted HTML page. Public details confirm the issue affects Chromium/Chrome prior ...

CVE-2018-6102

CVE-2018-6102 affects Google Chrome/Chromium, enabling an attacker to spoof the Omnibox (URL bar) via a crafted domain name. The vulnerability is described as a URL spoofing issue in Omnibox and is fixed in Chrome/Chromium around version 66.0.3359.117 (example Debian update notes reference 66.0.3...

CVE-2018-7334

Wireshark vulnerability CVE-2018-7334 affects the UMTS MAC dissector in Wireshark 2.4.0–2.4.4 and 2.2.0–2.2.12. Root cause: a reserved value was not rejected in the UMTS MAC dissector (packet-umts_mac.c), allowing a crafted packet to crash the dissector. Impact: denial of service via crash; poten...

CVE-2019-14824

CVE-2019-14824 affects 389-ds-base and its deref plugin, enabling an authenticated attacker to disclose attribute values by abusing the search permission (e.g., password hashes). Public details across connected docs confirm the flaw and show patches across multiple distros: Debian (fixed in 1.3.3...

CVE-2020-10729

CVE-2020-10729 describes a vulnerability in Ansible where insufficiently random values cause two password lookups of the same length to produce identical results during template caching, potentially exposing all passwords for a file. Affected: Ansible Engine versions before 2.9.6. Root cause: re-...

CVE-2021-21218

CVE-2021-21218 maps to a memory-disclosure flaw in PDFium used by Google Chrome before 90.0.4430.72. A crafted PDF could let remote attackers read potentially sensitive data from process memory. Remediation is to upgrade Chrome to 90.0.4430.72 or newer as indicated by multiple advisories.

CVE-2021-29454

Smarty (PHP templating engine) prior to versions 3.1.42 and 4.0.2 is vulnerable to arbitrary PHP code execution via the math function when a malicious math string is supplied by user data. Root cause: the math function can evaluate crafted strings, enabling remote code execution. Affected product...

CVE-2021-37991

CVE-2021-37991 is a race condition in the V8 component of the Chromium browser engine prior to version 95.0.4638.54 that could enable a remote attacker to potentially cause heap corruption via a crafted HTML page. The connected advisories confirm the issue affects Chromium/Chrome builds before th...

CVE-2021-37995

CVE-2021-37995 affects Chromium-based browsers (e.g., Google Chrome/Chromium) via an inappropriate implementation in the WebApp Installer before 95.0.4638.54. A remote attacker could potentially overlay and spoof the Omnibox (URL bar) contents with a crafted HTML page. The vulnerability is part o...

CVE-2021-39926

CVE-2021-39926 is a buffer overflow in the Wireshark Bluetooth HCI_ISO dissector (Wireshark 3.4.0–3.4.9) that can cause a denial of service via crafted packets or captures. Public docs consistently name Wireshark as affected and indicate the issue is fixed in newer builds: Debian notes a fix in 3...

CVE-2021-4062

CVE-2021-4062 is a heap buffer overflow in the BFCache component of Chromium/ Google Chrome prior to 96.0.4664.93. The issue affects the BFCache path, enabling a remote attacker who has compromised the renderer process to potentially trigger heap corruption via a crafted HTML page. The vulnerabil...

CVE-2022-23527

CVE-2022-23527 affects mod_auth_openidc for Apache 2.x. Versions prior to 2.4.12.2 are vulnerable to an Open Redirect caused by improper validation in oidc_validate_redirect_url() for logout redirect URIs that may start with a tab (\t). The issue can be mitigated by upgrading to 2.4.12.2; if upgr...

CVE-2022-26846

SPIP CMS vulnerable: affected versions are SPIP before 3.2.14 and 4.x before 4.0.5. Root cause involves input handling allowing remote authenticated editors to execute arbitrary code. Impact is remote code execution with high severity (per CVSS). Mitigation: upgrade to SPIP 3.2.14 or 4.0.5 (or la...

CVE-2022-33745

The CVE-2022-33745 issue is in the Xen hypervisor affecting x86 paravirtualized guests. The root cause is an incorrect TLB flush condition after code movement inside Xen, causing some necessary TLB flushes to be omitted when running PV guests in shadow paging mode (to support migrations and L1TF ...

CVE-2023-2463

CVE-2023-2463 : In Google Chrome (Android), an inappropriate implementation in Full Screen Mode could allow a remote attacker to hide the contents of the Omnibox (URL bar) via a crafted HTML page. Affected software is Chrome/Chromium family, with the issue linked to Full Screen handling. The vuln...

CVE-2023-51714

The CVE-2023-51714 entry concerns Qt’s HTTP/2 HPack handling: an incorrect HPack integer overflow check in network/access/http2/hpacktable.cpp affects Qt base components. Affected are Qt before 5.15.17, 6.x before 6.2.11, 6.3.x–6.5.x before 6.5.4, and 6.6.x before 6.6.2. The issue’s impact is des...

CVE-2024-26752

CVE-2024-26752 affects the Linux kernel L2TP/IP6 path: a miscalculated ulen in l2tp_ip6_sendmsg (ulen = len + skb_queue_empty(...) ? transhdrlen : 0) due to operator precedence caused incorrect transport-header accounting, leading to corrupted packets on the wire. The fix adds parentheses to alig...

CVE-2025-23141

CVE-2025-23141: In the Linux kernel KVM x86, acquiring the SRCU lock when retrieving MP state (KVM_GET_MP_STATE) can trigger a nested VM-Exit and potentially access guest memory in edge cases (e.g., L2 with INIT and pending TRIPLE_FAULT). The issue arises when the vCPU handling of MP state intera...

CVE-2025-37781

CVE-2025-37781 affects the Linux kernel involving the i2c Cros EC tunnel. When i2c-cros-ec-tunnel and the EC driver are built-in, the EC parent device may not be found, causing a NULL pointer dereference. The issue can be reproduced by unbinding the controller driver and re-loading the i2c-cros-e...

CVE-2025-37928

CVE-2025-37928 refers to a Linux kernel vulnerability in the dm-bufio path where scheduling in atomic context can occur when try_verify_in_tasklet is enabled and CONFIG_DEBUG_ATOMIC_SLEEP is set. The bug arises from sleeping in an invalid context, potentially enabling local privilege escalation o...

CVE-2009-0946

The CVE-2009-0946 issue affects the FreeType font engine (FreeType 2.3.9 and earlier). The vulnerability arises from multiple integer overflows in the engine, exploitable via crafted font input in components such as smooth/ftsmooth.c, sfnt/ttcmap.c, and cff/cffload.c, potentially allowing remote ...

CVE-2011-4968

CVE-2011-4968 concerns the nginx http proxy module failing to verify the peer identity of the HTTPS origin server, enabling potential MITM attacks. The vulnerability is described as an information-security issue in the nginx proxy component where TLS peer verification is not performed for upstrea...

CVE-2013-0776

CVE-2013-0776 affects Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16. The flaw allows a man-in-the-middle attacker to spoof the address bar by using a proxy server that returns a 407 HTTP status...

CVE-2013-3839

CVE-2013-3839 affects MySQL/MariaDB: remote authenticated users could affect availability via the Optimizer in Oracle MySQL Server 5.1.70 and earlier, 5.5.32 and earlier, and 5.6.12 and earlier. Connected advisories (RHSA-2014:0189; CentOS/CESA entries) document the impact across affected MariaDB...

CVE-2014-6055

CVE-2014-6055 is a LibVNCServer (rfbserver.c) vulnerability: multiple stack-based buffer overflows in the File Transfer feature could allow remote authenticated users to crash the server and potentially execute arbitrary code. Affected product/version reference in the sources includes LibVNCServe...

CVE-2015-0374

CVE-2015-0374 is a MySQL/MariaDB server vulnerability impacting confidentiality via unknown vectors in Foreign Key handling. Affected products and versions include Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier (and MariaDB/forked releases in corresponding lines). Public advisories...

CVE-2015-3234

The vulnerability CVE-2015-3234 affects the Drupal OpenID module in Drupal 6.x (before 6.36) and 7.x (before 7.38). A remote attacker can authenticate as other users by presenting an OpenID identity from certain providers (e.g., Verisign, LiveJournal, StackExchange). Root cause: improper validati...

CVE-2016-0646

CVE-2016-0646 is an unspecified vulnerability in Oracle MySQL Server (DML-related) that can affect availability via local access. Connected advisories confirm multiple MariaDB/MySQL fixes and provide concrete remediations: upgrade to fixed upstream versions (e.g., MariaDB 10.0.25+ per Debian DSA-...

CVE-2016-1697

CVE-2016-1697 affects Google Chrome (Blink/WebKit) prior to 51.0.2704.79. The FrameLoader::startLoad path in FrameLoader.cpp does not prevent frame navigations during DocumentLoader detach, enabling a remote attacker to bypass the Same Origin Policy via crafted JavaScript. A patch was released in...

CVE-2017-13024

The CVE-2017-13024 issue affects tcpdump before 4.9.2, where the IPv6 mobility parser’s mobility_opt_print() performs a buffer over-read. The vulnerability exists in versions prior to 4.9.2 and can lead to information disclosure or crash. Mitigation: upgrade tcpdump to version 4.9.2 or later (pat...

CVE-2017-14167

CVE-2017-14167 affects QEMU’s multiboot header handling in the PC System Emulator. An integer overflow in the load_multiboot function can cause an out-of-bounds access/write when processing multiboot headers, which local guest users could leverage to execute arbitrary code on the host. Public ref...