CVE-2017-7746

Wireshark CVE-2017-7746 affects Wireshark 2.2.0–2.2.5 and 2.0.0–2.0.11. The SLSK dissector could enter an infinite loop triggered by a crafted or malformed capture file or packet injection. Root cause: missing checks for the remaining length in epan/dissectors/packet-slsk.c. Impact: potential den...

CVE-2017-7763

CVE-2017-7763 : On macOS OS X, default fonts render some Tibetan characters as whitespace, enabling spoofing when used in an IDN in the address bar. Affected products/versions (per connected docs): Firefox versions before 54, Firefox ESR before 52.2, and Thunderbird before 52.2. The issue is spec...

CVE-2018-10753

CVE-2018-10753 is a stack-based buffer overflow in the delayed_output function of music.c in abcm2ps (up to release 8.13.20). It allows remote attackers to cause a denial of service (crash) and potentially other impact. Debian LTS and related advisories document a fix in abcm2ps version 7.8.9-1+d...

CVE-2018-16981

CVE-2018-16981 affects the stb image library (stb stb_image.h) 2.19 as used in projects like MAME/catimg/Emscripten. The vulnerability is a heap-based buffer overflow in stbi__out_gif_code, with advisories (Ubuntu USN-7913-1, Debian DLA-3305-1, Debian patch notes) documenting this issue in stb an...

CVE-2018-20760

CVE-2018-20760 affects GPAC up to version 0.7.1, where gf_text_get_utf8_line in media_tools/text_import.c can cause an out-of-bounds write due to mishandled -1 return. Ubuntu/Debian advisories and OSV entries group this with other GPAC flaws (memory operation handling, buffer overflows) and warn ...

CVE-2018-6392

CVE-2018-6392 affects FFmpeg (libavfilter/vf_transpose.c: filter_slice). A crafted MP4 can trigger an out-of-bounds access, causing a denial of service. Documented impact: remote attacker could cause DoS; no exploit details provided beyond this. Affected products/versions: FFmpeg up to 3.4.1 per ...

CVE-2018-6791

CVE-2018-6791 affects KDE Plasma Workspaces; the vulnerability exists in soliduiserver/deviceserviceaction.cpp and is triggered when a VFAT thumbdrive with volume labels like "$(touch b)" or labels containing `` or $() is mounted via the device notifier, causing arbitrary command execution. Upstr...

CVE-2018-7872

CVE-2018-7872 affects libming 0.4.8, where an invalid memory address dereference in getName for CONSTANT16 data causes a segmentation fault and application crash, leading to denial of service. Connected advisories (Mageia MGASA-2019-0137 and Fedora/Nessus OpenVAS entries) confirm this as part of ...

CVE-2018-8763

CVE-2018-8763 affects LDAP Account Manager prior to 6.3, with a Reflected XSS via the dn parameter to templates/3rdParty/pla/htdocs/cmd.php or the cmd=rename_form parameter. The issue is documented across Debian security advisories (DSA-4165-1) and related OSS/Nessus references. Debian fixes: old...

CVE-2019-17349

CVE-2019-17349 is a Xen hypervisor DoS vulnerability affecting Xen through 4.12.x. The issue allows an unprivileged Arm domU attacker to cause an infinite loop during LoadExcl/StoreExcl operations, leading to a denial of service. Public details reference a Xen XSA-295 advisory describing the DoS ...

CVE-2019-17637

CVE-2019-17637 affects Eclipse Web Tools Platform up to version 3.18 (2020-06). The vulnerability arises in XML/DTD processing where external entities can cause local file contents to be sent to a remote server when files are edited or validated, even if external entity resolution is disabled. De...

CVE-2019-18422

CVE-2019-18422 affects the Xen hypervisor (ARM guests) where interrupts are unconditionally unmasked in exception handlers. When an exception occurs on ARM and is handled without changing the processor level, some interrupts can be unmasked during entry, allowing a malicious guest to run critical...

CVE-2019-18823

CVE-2019-18823 affects HTCondor up to and including stable 8.8.6 and development 8.9.4, where improper access control allows impersonation of another user to condor_schedd if a READ/WRITE method includes CLAIMTOBE. This enables submitting or removing jobs without proper administrator-specified au...

CVE-2020-10936

CVE-2020-10936 affects Sympa (mailing list manager). Multiple advisories (Debian DSA-4818, Ubuntu USN-4442-2, OSV) confirm a local privilege-escalation flaw in Sympa related to improper handling of environment variables when a setuid context is involved, enabling root-level access in affected ins...

CVE-2020-36306

CVE-2020-36306 affects Redmine up to 4.0.7 and 4.1.x up to 4.1.1, where the back_url field enables Cross-Site Scripting (XSS). Root cause: inadequate sanitization of back_url in these versions. Impact: XSS via user-supplied data in the back_url parameter; exposure depends on context. Mitigation: ...

CVE-2020-36421

CVE-2020-36421 affects Arm Mbed TLS up to version 2.22.x (before 2.23.0). A side-channel in modular exponentiation could disclose an RSA private key used in a secure enclave, causing partial confidentiality loss of the key material. The vulnerability is documented across multiple sources (e.g., A...

CVE-2020-6080

Vulnerability CVE-2020-6080 affects Videolabs libmicrodns 0.1.0. The issue is in mDNS message parsing/resource allocation handling, where errors during parsing can leave allocated data unfreed, enabling denial-of-service via resource exhaustion. The Arch Linux ASA-202004-24 describes multiple CVE...

CVE-2021-21847

CVE-2021-21847 affects the GPAC Project on Advanced Content library (version 1.0.1) and is due to an unchecked arithmetic path in the MPEG-4 decoding for the MPEG-4 atom/parsing, specifically the stts decoder, leading to an integer overflow and a heap-based buffer overflow that causes memory corr...

CVE-2022-28201

CVE-2022-28201 affects MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The root cause is an infinite recursion triggered when a user with editinterface permission mishandles a bare local interwiki for the mainpage message. This can lead to a denial of service via recursio...

CVE-2022-38855

Summary of findings (CVE-2022-38855 and related): The MPlayer Project’s mplayer and mencoder (SVN-r38374-13.0.1) are affected by multiple vulnerabilities across demux and codec code paths. Concrete issues in the Connected documents include: buffer overflow via gen_sh_video() in mplayer/libmpdemux...

CVE-2022-43597

CVE-2022-43597 affects OpenImageIO (OpenImageIO v2.4.4.2) via multiple memory corruption vulnerabilities in IFFOutput alignment padding, triggered when m_spec.format is TypeDesc::UINT8. The issue can lead to arbitrary code execution. Public advisories reference affected versions and fixes; remedi...

CVE-2023-24751

CVE-2023-24751 affects libde265 v1.0.10, with a NULL pointer dereference in mc_chroma (motion.cc) leading to Denial of Service via crafted input. Public advisories (e.g., Debian DLA-3352-1) fix this by upgrading to libde265 1.0.11 (and related package updates). Other connected sources (Astra Linu...

CVE-2024-12425

CVE-2024-12425 concerns LibreOffice: an improper PATH traversal in the Document Foundation implementation allows an attacker to write to arbitrary locations (suffixing outputs with .ttf) by supplying a file that contains embedded font data. Affected versions are LibreOffice 24.8 and earlier than ...

CVE-2024-34508

DCMTK component dcmnet is affected by a segmentation fault caused by an invalid DIMSE message in versions before 3.6.9. The CVE-2024-34508 entry documents this issue with a network-facing DIMSE processing fault that can lead to a crash. The connected advisories consistently indicate remediation b...

CVE-2025-39718

CVE-2025-39718 affects the Linux kernel’s vsock/virtio handling. The issue arises when receiving a vsock packet: virtio_vsock_skb_rx_put() uses the packet header length as the skb_put() length without proper validation, risking an SKB overflow if the header length is not trustworthy. The fix vali...

CVE-2007-0897

CVE-2007-0897 affects ClamAV (clamav); the issue is due to not closing open file descriptors when processing CAB archives with a cabinet header length of zero, leading to denial of service via file descriptor exhaustion. OpenVAS/OpenVulnerability entries reference this CVE alongside related issue...

CVE-2008-2137

The CVE-2008-2137 entry describes a Linux kernel vulnerability in the SPARC/SPARC64 mmap checks. Affected are Linux kernel 2.4 before 2.4.36.5 and 2.6 before 2.6.25.3, where sparc_mmap_check (arch/sparc/kernel/sys_sparc.c) and sparc64_mmap_check (arch/sparc64/kernel/sys_sparc.c) omit some virtual...

CVE-2008-5701

CVE-2008-5701 is a Linux kernel local denial-of-service vulnerability on 64-bit MIPS platforms caused by an array index error in arch/mips/kernel/scall64-o32.S. It affects kernel versions prior to 2.6.28-rc8, where an o32 syscall with a small number can trigger an out-of-bounds access to the sysc...

CVE-2010-1187

The CVE-2010-1187 issue affects the Linux kernel TIPc (Transparent Inter-Process Communication) implementation, reported for kernel versions 2.6.16-rc1 through 2.6.33 (and potentially other versions). The vulnerability allows a local user to trigger a NULL pointer dereference and cause a kernel O...

CVE-2010-2901

CVE-2010-2901 affects Google Chrome rendering before 5.0.375.125, with memory corruption enabling remote denial of service via unknown vectors. Public records in multiple feeds (Ubuntu USN-1195-1, openSUSE, Gentoo GLSA/GNU patches) confirm this CVE and reference a Chrome/Chromium exposure prior t...

CVE-2011-0983

Technical details for CVE-2011-0983 are not publicly available in the provided connected documents. Monitor for updates from official advisories; no product, impact, or remediation specifics are provided here.

CVE-2011-2359

Technical details about CVE-2011-2359 (affected product/versions, root cause, impact, fix) are not publicly available in the provided connected documents. Monitor for updates.

CVE-2012-0812

PostfixAdmin 2.3.4 is affected by multiple XSS vulnerabilities due to insufficient input validation in the web interface. Impact stated as client-side code execution possibilities; exploitation details are not provided in the supplied documents. A remediation exists: upgrade to PostfixAdmin 2.3.5...

CVE-2013-2072

CVE-2013-2072 is a buffer overflow in the Python bindings for xc_vcpu_setaffinity in Xen 4.0.x–4.2.x. Local administrators with VCPU affinity configuration permissions could trigger memory corruption, toolstack crashes, and potentially privilege escalation via a crafted cpumap. Connected advisori...

CVE-2013-2878

CVE-2013-2878 affects Google Chrome prior to 28.0.1500.71, with the described vulnerability being an out-of-bounds read in text handling that can be exploited remotely to cause denial of service. The issue is documented across multiple sources (including the CVE entry and Debian security advisory...

CVE-2013-2884

CVE-2013-2884 is a use-after-free in the DOM implementation of Google Chrome prior to 28.0.1500.95, related to improper tracking of which document owns an Attr object. This could allow remote denial of service or other impact. Public details in connected sources confirm affected product as Chrome...

CVE-2013-4158

CVE-2013-4158 affects Smokeping prior to 2.6.9 . Root cause: XSS in the web interface (incomplete fix for CVE-2012-0790). Impact: potential for client-side code execution via the web UI. Affected products/versions are documented in multiple sources; remediation : upgrade to Smokeping 2.6.9 or new...

CVE-2014-3169

CVE-2014-3169 is a use-after-free in Blink/WebKit DOM (ContainerNode.cpp) affecting Google Chrome up to 37.0.2062.94. It can allow a remote attacker to cause denial of service or possibly other impact via script execution before node removal notification. Advisories from Debian, Ubuntu, openSUSE,...

CVE-2014-8483

CVE-2014-8483 affects Konversation (IRC client for KDE). The issue is a missing size check in Blowfish ECB blocks, leading to an out-of-bounds read that can cause crashes and potentially leak up to 11 bytes. Patches/mitigations: updated Konversation versions (1.5.1) and related KDE Platform requi...

CVE-2015-1240

The CVE-2015-1240 entry applies to Google Chrome’s WebGL implementation (gpu/blink/webgraphicscontext3d_impl.cc) and describes an out-of-bounds read in WebGL that can be triggered by a crafted WebGL program, potentially causing denial of service due to a state inconsistency. Affected version is C...

CVE-2015-5316

The CVE-2015-5316 issue affects wpa_supplicant (2.x) prior to 2.6, in the eap_pwd_perform_confirm_exchange function inside eap_pwd.c. When EAP-pwd is enabled in a network profile, processing an EAP-pwd Confirm message followed by the Identity exchange can trigger a NULL pointer dereference, leadi...

CVE-2015-8807

The CVE-2015-8807 issue affects Horde Groupware before 5.2.12 and Horde Groupware Webmail Edition before 5.2.12. The vulnerability resides in Horde’s _renderVarInput_number function within Html.php, enabling remote attackers to inject arbitrary web script or HTML via numbers in form fields (XSS)....

CVE-2016-1922

CVE-2016-1922 : QEMU built with the TPR optimization for 32-bit Windows guests is vulnerable to a NULL pointer dereference during I/O port write operations via the hmp interface , where the current_cpu may be null. This can crash the QEMU instance, causing a DoS. No patch/version details are prov...

CVE-2016-2228

CVE-2016-2228 is a cross-site scripting (XSS) vulnerability in Horde Groupware prior to 5.2.12 and Horde Groupware Webmail Edition prior to 5.2.12. The issue allows remote attackers to inject arbitrary web script or HTML via the searchfield parameter, demonstrated by a request to xplorer/gollem/m...

CVE-2016-2347

The CVE affects the Lhasa library (lib/lha_file_header.c: decode_level3_header) and is due to an integer underflow that can lead to remote code execution via a crafted archive. Fixed in Lhasa 0.3.1 (upstream) and addressed in OSV/NVD records; published advisories indicate a heap/underflow vulnera...

CVE-2016-4348

CVE-2016-4348 affects librsvg 2.40.2: the _rsvg_css_normalize_font_size function allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via circular definitions in an SVG document. The provided documents confirm the vulnerability details but do n...

CVE-2017-0366

CVE-2017-0366 affects MediaWiki prior to 1.28.1, 1.27.2, and 1.23.16, where a flaw in how default attributes in SVG DTD declarations are handled allows evading SVG filters. Root cause: incorrect SVG filter handling enabling bypass of filters in SVG contexts. Impact: as stated, evading graphical f...

CVE-2017-2905

CVE-2017-2905 affects Blender 2.78c, where an exploitable integer overflow in the BMP loading functionality can trigger a buffer overflow and execute code. A specially crafted BMP file could be provided as an asset via Blender’s sequencer to a user, leading to potential code execution in the appl...

CVE-2017-6302

CVE-2017-6302 is a vulnerability in libytnef (ytnef) where improper bounds checking in decoding TNEF data can lead to heap-related errors. Advisories describe multiple heap overflows and out-of-bounds reads/writes via crafted winmail.dat, potentially enabling crash or exploitation. Affected packa...

CVE-2017-8846

CVE-2017-8846 affects lrzip 0.631. The read_stream function in lrzip’s lrzip/liblrzip.so has a use-after-free vulnerability that can cause a denial of service via a crafted archive. Public references (Debian/Ubuntu advisories and Gentoo GLSA) confirm the issue and track fixes. Remediation involve...