CVE-2019-16728

Summary: CVE-2019-16728 affects DOMPurify prior to 2.0.1, enabling cross-site scripting via innerHTML mutation XSS (mXSS) in SVG or MATH elements, demonstrated in Chrome and Safari. Affected component: DOMPurify (HTML, MathML, SVG sanitization code). Root cause: improper handling of innerHTML mut...

CVE-2019-18222

CVE-2019-18222 affects Arm Mbed Crypto 2.1 and Mbed TLS up to 2.19.1: the ECDSA implementation in ecdsa.c does not reduce the blinded scalar before the inverse, enabling local side-channel attacks to recover the private key. Several advisories report upstream fixes (e.g., 2.20.0, 3.0.1) and packa...

CVE-2020-19144

CVE-2020-19144 is a LibTIFF vulnerability (buffer overflow in _TIFFmemcpy in tif_unix.c) that can cause denial of service. Connected documents show public advisories confirming LibTIFF memory handling issues (and related CVEs) and vendor/OS security notices (Ubuntu/Debian) that include fixes for ...

CVE-2020-9481

Apache Traffic Server (ATS) is affected by CVE-2020-9481. Versions 6.0.0–6.2.3, 7.0.0–7.1.9, and 8.0.0–8.0.6 are vulnerable to a HTTP/2 slow read attack, which can lead to denial of service (and is described in multiple sources as affecting ATS). The vulnerability stems from HTTP/2 handling in AT...

CVE-2021-20300

CVE-2021-20300 affects OpenEXR’s hufUncompress in ImfHuf.cpp, where processing a crafted EXR file can trigger an integer overflow, with the highest impact reported as availability disruption. The vulnerability is documented in NVD and repeated in multiple advisories (Debian/Red Hat/Nessus feeds) ...

CVE-2021-30485

CVE-2021-30485 affects ezXML 0.8.6 (libezxml.a). The issue is a NULL pointer dereference in ezxml_internal_dtd() during XML parsing, caused by memory handling that can lead to a NULL pointer being passed to strcmp(). The connected documents consistently reference this exact flaw in ezXML 0.8.6, i...

CVE-2021-32435

CVE-2021-32435 affects abcm2ps (v8.14.11). The issue is a stack-based buffer overflow in parse.c:get_key, enabling DoS via crafted input. Public advisories confirm affected packages and fixes, with OpenSUSE/SUSE and Debian notes updating to newer abcm2ps releases (e.g., 8.14.13 in SUSE/openSUSE a...

CVE-2021-3582

CVE-2021-3582 is described in connected Astra Linux advisories as a flaw in the QEMU implementation of VMware’s paravirtual RDMA (pvrdma) device. The issue occurs while handling the PVRDMA_CMD_CREATE_MR command due to improper memory remapping (mremap). This can allow a malicious guest to crash t...

CVE-2022-1920

CVE-2022-1920 affects gst-plugins-good1.0 (GStreamer) with an integer overflow in the matroskademux header processing, enabling a heap overwrite and potential arbitrary code execution when parsing Matroska files. Public advisories (Debian, Mageia, AlmaLinux, Gentoo) document fixes in updated gst-...

CVE-2022-26356

CVE-2022-26356 describes a race in Xen between log-dirty tracking and log-dirty hypercalls. Activation of log-dirty via XEN_DMOP_track_dirty_vram can race with tearing down structures from a prior log-dirty mode, causing entries to be written into freed slots and resulting in a memory leak. Vulne...

CVE-2022-30785

NTFS-3G contains a local memory read/write vulnerability triggered by a file handle created in fuse_lib_opendir and later used in fuse_lib_readdir when using libfuse-lite. The issue affects NTFS-3G up to 2021.8.22 (through libfuse-lite) and can enable arbitrary memory access. Public exploit detai...

CVE-2022-37797

CVE-2022-37797 affects lighttpd 1.4.65 where mod_wstunnel fails to initialize a handler function pointer on invalid websocket handshake requests, causing a NULL pointer dereference and denial of service. Public advisories indicate fixes in newer lighttpd releases (e.g., lighttpd 1.4.67 and later)...

CVE-2022-40302

CVE-2022-40302 affects FRRouting (FRR) bgpd through 8.4. An attacker can cause a DoS by sending a BGP OPEN message with an option of type 0xff (Extended Length from RFC 9072) due to inconsistent boundary checks that read 3 bytes instead of 2 in this case, potentially triggering an assertion failu...

CVE-2023-52670

CVE-2023-52670 is a Linux kernel issue affecting rpmsg: virtio where driver_override is freed only partially during rpmsg_remove, causing a memory leak for an unreferenced object (size 128, shown in the backtrace). The vulnerability was resolved in the Linux kernel by freeing driver_override duri...

CVE-2024-26970

CVE-2024-26970 affects the Linux kernel clock driver for Qualcomm IPQ6018 (clk: qcom: gcc-ipq6018). Root cause: frequency table arrays lacked a terminating empty element, risking out-of-bounds access when traversed by qcom_find_freq() or qcom_find_freq_floor(). Mitigation: patch adds an empty ter...

CVE-2024-36957

CVE-2024-36957 affects the Linux kernel driver octeontx2-af. The vulnerability is due to an off-by-one read from userspace when attempting to copy count + 1 bytes (memdup_user(buffer, count + 1)), while the userspace buffer only contains count bytes. The fix prevents this by using memdup_user_nul...

CVE-2025-37767

The CVE-2025-37767 entry describes a Linux kernel vulnerability in the drm/amd/pm path where division by zero is possible if the user sets a speed value greater than UINT_MAX/8. The flaw is triggered locally and carries a CVSSv3.1 base score of 5.5 (Medium) with impactLimited to availability and ...

CVE-2025-37844

CVE-2025-37844 refers to a Linux kernel issue in the CIFS subsystem. The vulnerability arises from a NULL pointer dereference in a dbg call path: cifs_server_dbg() could be invoked with a NULL server. The fix moves the dbg call under a conditional so the server is ensured non-NULL before access. ...

CVE-2014-3467

GNUTLS/library libtasn1 vulnerability CVE-2014-3467 is due to multiple issues in the DER decoder of GNU Libtasn1 up to version 3.5.x (pre-3.6), exploited by crafted ASN.1 data to cause a denial of service via out-of-bounds read. The issue is confirmed in multiple advisories (F5 SOL15423, ALAS-201...

CVE-2014-3647

CVE-2014-3647 affects the Linux kernel KVM emulation path: arch/x86/kvm/emulate.c. The root cause is improper handling of RIP changes during instruction emulation, enabling a local guest OS user to crash the guest (DoS) with a crafted application in kernels up to 3.17.2. The provided connected do...

CVE-2014-4341

MIT Kerberos 5 (krb5) CVE-2014-4341 is a remote DoS in which an attacker can cause a buffer over-read and crash a GSSAPI session by injecting invalid tokens. Public sources tie this to krb5 releases prior to 1.12.2 (upstream flag) and show impact on servers/applications using GSSAPI SPNEGO. The F...

CVE-2015-1420

CVE-2015-1420 is a Linux kernel race condition in fs/fhandle.c (handle_to_path) up to version 3.19.1. An attacker could bypass size restrictions by manipulating handle_bytes during handle_to_path execution to trigger reads from additional memory locations, enabling local read access to memory. Th...

CVE-2015-8551

CVE-2015-8551 affects the Xen PCI backend driver (pciback) when Xen runs on x86 with a Linux 3.1.x–4.3.x driver domain. The issue arises from missing sanity checks in XEN_PCI_OP_* operations, allowing a local guest administrator with access to a passed-through MSI/MSI-X PCI device to trigger BUG ...

CVE-2015-8605

CVE-2015-8605 affects ISC DHCP 4.x (4.1-ESV-R12-P1, 4.2.x, 4.3.x up to 4.3.3-P1). A remote attacker can crash the DHCP server/client/relay by sending a UDP IPv4 packet with an invalid length field, causing a denial of service. IBM and F5 advisories document vendor-specific fixes and recommended u...

CVE-2016-2828

CVE-2016-2828 is a use-after-free in Mozilla Firefox/WebGL texture handling (texture access after recycle pool destruction) that could allow remote code execution. Public details show impact on Firefox before 47.0 and ESR 45.x before 45.2. Remediation varies by vendor: upgrade Firefox/Firefox ESR...

CVE-2016-8677

CVE-2016-8677 affects ImageMagick. The AcquireQuantumPixels function (MagickCore/quantum.c) can be triggered by a crafted image to cause a memory allocation failure, producing an unspecified impact. Affected: ImageMagick versions before 7.0.3-1. Fix: upgrade to 7.0.3-1 or newer (patched release).

CVE-2016-9573

CVE-2016-9573 is an out-of-bounds read in OpenJPEG 2.1.2 (j2k_to_image tool). A crafted JPEG2000 file could crash the app or potentially disclose heap data. No exploitation details are provided in the documents. Remediation guidance across connected sources indicates upgrading OpenJPEG (e.g., to ...

CVE-2017-12606

OpenCV (Open Source Computer Vision Library) up to version 3.3 is affected by CVE-2017-12606 due to an out-of-bounds write in FillColorRow4 in utils.cpp when reading an image with cv::imread. The described impact is memory corruption, with exploitation status not provided in the supplied document...

CVE-2017-12936

GraphicsMagickCVE-2017-12936 affects the ReadWMFImage function (coders/wmf.c) with a use-after-free condition tied to exception reporting. The Arch/AS A advisory and multiple vendor advisories describe this as allowing arbitrary code execution on affected systems before mitigation. Upstream fix t...

CVE-2017-15119

CVE-2017-15119 affects the NBD server in Quick Emulator (QEMU). The NBD server can be DoSed if a client sends oversized option requests, causing the server to spend CPU time reading up to 4 GB per request and potentially starving other requests. This vulnerability is described as occurring in QEM...

CVE-2017-15396

CVE-2017-15396 is described in the connected IBM ICU bulletin as a stack buffer overflow in ICU’s NumberingSystem (C/C++) that could allow a remote attacker to trigger heap corruption via a crafted HTML page. The description in the initial document notes ICU for C/C++ before 60.2 (used in V8/Chro...

CVE-2017-16352

CVE-2017-16352 affects GraphicsMagick 1.3.26 and is a heap-based buffer overflow in the Display visual image directory feature of DescribeImage() (magick/describe.c). Trigger: running identify on a specially crafted MIFF file with the verbose flag. Impact details in the vulnerability describe onl...

CVE-2017-7758

CVE-2017-7758 describes an out-of-bounds read in the Opus encoder when the number of channels in an audio stream changes during encoding. Affected products include Firefox < 54, Firefox ESR < 52.2, and Thunderbird

CVE-2018-1000132

CVE-2018-1000132 affects Mercurial 4.5 and earlier, with an Incorrect Access Control (CWE-285) in the Protocol server that can lead to unauthorized data access over the network. The vulnerability is explicitly stated to have been fixed in Mercurial 4.5.1. Connected advisories reference affected p...

CVE-2018-15209

CVE-2018-15209 — LibTIFF 4.0.9 is affected by a heap-based buffer overflow in ChopUpSingleUncompressedStrip (tif_dirread.c) that can be exploited by a crafted TIFF file (as demonstrated by tiff2pdf), potentially causing a denial of service or other unspecified impact. The connected Nessus/MIRACLE...

CVE-2018-17474

CVE-2018-17474 concerns a use-after-free in the Blink component, specifically in the HTMLImportsController, affecting Google Chrome and Blink before version 70.0.3538.67. The issue could allow a remote attacker to cause heap corruption via a crafted HTML page, as described in multiple sources. Th...

CVE-2018-18345

CVE-2018-18345 affects Google Chrome/Chromium WebKit-based browsers prior to 71.0.3578.80, with an error in Site Isolation that allowed a renderer-compromised page to bypass site isolation protections. Public sources in the connected docs identify the issue as an access-restriction bypass in Site...

CVE-2018-18357

CVE-2018-18357 involves Google Chrome’s URL Formatter. The issue is an insufficient policy enforcement in the URL Formatter component, allowing a remote attacker to spoof the Omnibox content with a crafted domain name. Affected versions are prior to 71.0.3578.80 (Chrome/Chromium), with mitigation...

CVE-2018-5185

CVE-2018-5185 is a vulnerability in Mozilla Thunderbird where plaintext of decrypted emails can leak through when a user submits an embedded form. The public descriptions specify the affected products as Thunderbird ESR < 52.8 and Thunderbird

CVE-2018-6031

CVE-2018-6031 is a use-after-free in PDFium used by Google Chrome before 64.0.3282.119, allowing a remote attacker to potentially trigger heap corruption via a crafted PDF file. Public advisories confirm Chrome/Chromium updates addressing this CVE (64.0.3282.119 and later). Affected product is Go...

CVE-2018-6077

CVE-2018-6077 is a Chrome/Blink vulnerability described as a timing attack in SVG filters. Displacement map filters applied to cross-origin images could leak cross-origin data via a crafted HTML page. Affected product: Google Chrome (Blink SVG rendering). Root cause: timing issue in SVG filter pr...

CVE-2020-14404

CVE-2020-14404 affects LibVNCServer before version 0.9.13, with the root cause being out-of-bounds access in the rre.c encodings path. Affected component: libvncserver (server-side handling of Encodings). Impact as stated: potential information disclosure or denial of service with low confidentia...

CVE-2020-19143

CVE-2020-19143 affects LibTIFF 4.0.10, where a buffer overflow in libtiff/tif_dir.c (TIFFVGetField) can cause a denial of service. Connected sources confirm this vulnerability in LibTIFF and cite Debian/Ubuntu advisories that patch the issue; Debian DSA-4997-1 fixes it in version 4.1.0+git191117-...

CVE-2021-3607

CVE-2021-3607 affects QEMU’s implementation of VMware’s paravirtual RDMA device. An integer overflow occurs when handling the PVRDMA_REG_DSRHIGH write from the guest due to improper input validation, allowing a privileged guest user to cause QEMU to allocate a large amount of memory, resulting in...

CVE-2021-37988

CVE-2021-37988 is a use-after-free in the Profiles component of the Chromium browser engine (Chromium/Chrome), prior to version 95.0.4638.54. A remote attacker could lure a user to perform specific gestures on a crafted HTML page to potentially trigger heap corruption. Supported details from secu...

CVE-2021-42387

CVE-2021-42387 affects ClickHouse. It describes a heap out-of-bounds read in the LZ4 compression codec during parsing a malicious query: a 16-bit unsigned offset read in LZ4::decompressImpl() is used to determine the copy length without checking the upper bounds of the source, potentially causing...

CVE-2022-24919

CVE-2022-24919 is a reflected XSS/CSRF type vulnerability in Zabbix frontend that is exploited via a link crafted by an authenticated user and sent to other users. The attack URL contains reflected JavaScript on the graphs page; the payload runs in the victim’s context only if the victim’s CSRF t...

CVE-2022-26498

CVE-2022-26498 affects Asterisk up to 19.x. STIR/SHAKEN handling may allow downloading non-certificate files, leading to Resource Exhaustion . This is fixed in 16.25.2, 18.11.2, and 19.3.2 ; upgrade to one of these versions to remediate.

CVE-2022-31214

Firejail (version 0.9.68 affected) has a Privilege Context Switching flaw in join.c that lets a local user exploit a crafted join target to drop out of the initial user namespace and gain root privileges via setuid-root binaries. mitigations rely on upgrading to patched releases (e.g., Firejail 0...

CVE-2022-3551

CVE-2022-3551 affects X.Org Server; the memory leak is in ProcXkbGetKbdByName() in xkb/xkb.c. The provided documents consistently reference this CVE alongside related xorg-server issues (memory leak/cves 3550, 4283, etc.) and show that advisories from AlmaLinux, Amazon Linux, CentOS/RHEL, and Fed...