CVE-2001-0977

CVE-2001-0977 affects slapd in OpenLDAP, where OpenLDAP 1.x prior to 1.2.12 and 2.x prior to 2.0.8 are vulnerable. The issue is triggered by receiving LDAP BER length fields with invalid lengths, allowing remote attackers to cause a denial-of-service crash. Public advisories describe this as a re...

CVE-2025-39697

Technical details about CVE-2025-39697 are not publicly provided in the supplied documents; information on affected products, impact, and fixes is limited to a general description. Monitor updates from vendor advisories.

CVE-1999-0832

CVE-1999-0832 concerns a buffer overflow in the Linux NFS server triggered by a long pathname, allowing an attacker to execute commands. The linked records confirm the vulnerability exists in the NFS service on Linux and describe command execution as the impact. The provided documents do not spec...

CVE-2001-0458

CVE-2001-0458 : Multiple buffer overflows in ePerl prior to 2.2.14-0.7 allow local and remote attackers to execute arbitrary commands. Mandrake and Debian advisories note upgrades to 2.2.14-0.7 (or later) fix the issue; other references corroborate the vulnerability in ePerl.

CVE-2002-1232

CVE-2002-1232 describes a memory leak in ypserv’s ypdb_open (yp_db.c) affecting the NIS package prior to version 2.5. Repeated remote requests for non-existent maps can exhaust memory, causing a denial-of-service condition. Multiple vendor advisories document this issue (e.g., Mandrake MDKSA-2002...

CVE-2004-1145

CVE-2004-1145 affects Konqueror/KDE up to version 3.3.1 where the Java sandbox could be bypassed by JavaScript or Java applets, allowing read/write of arbitrary files. The issue resides in the sandbox restrictions for Java in Konqueror and the FTP kioslave handling in KDE, enabling remote code ex...

CVE-2011-0984

CVE-2011-0984 affects Google Chrome prior to 9.0.597.94, where the browser mishandles plug-ins, enabling a remote attacker to cause a denial of service via an out-of-bounds read. Public sources (including Debian DSA-2166-1 and OpenVAS entries) corroborate the family of Chrome/Chromium vulnerabili...

CVE-2011-1400

The CVE-2011-1400 issue affects the tex-common package, where the default shell_escape_commands setting in conf/texmf.d/95NonPath.cnf could allow remote code execution via a crafted TeX document. Affected distributions include Debian GNU/Linux squeeze and Ubuntu 10.04/10.10, with tex-common befor...

CVE-2012-1114

CVE-2012-1114: XSS vulnerability in LDAP Account Manager (LAM) Pro 3.6, triggered via the filter parameter to cmd.php in export/exporter_id and the filteruid parameter to list.php. Connected documents confirm the vulnerability details across multiple advisories; no exploits or mitigation steps ar...

CVE-2012-5476

OpenStack RHOS Essex Preview (2012.2) dashboard package contains a vulnerability where /etc/quantum/quantum.conf is world readable, exposing the admin password and token value. Affected component: OpenStack dashboard configuration on RHOS Essex Preview 2012.2. Root cause: file permissions misconf...

CVE-2013-2903

CVE-2013-2903 is a use-after-free in Blink’s HTMLMediaElement::didMoveToNewDocument. Affected software: Google Chrome (Blink) prior to 29.0.1547.57. Impact stated: remote attackers could cause a denial of service or other unspecified effects by moving audio/video elements between documents. Publi...

CVE-2013-4078

Wireshark 1.8.x before 1.8.8 has a flaw in the RDP dissector (epan/dissectors/packet-rdp.c) where return values are not validated during data-availability checks, enabling a crafted RDP packet to crash the application and cause a denial of service. This CVE-2013-4078 entry is supported by multipl...

CVE-2013-6476

CVE-2013-6476 affects cups-filters (pdftoopvp filter) and its OPVPWrapper.cxx path handling. The root cause is that the pdftoopvp filter did not restrict driver directories, allowing a local attacker to place a Trojan horse driver in the same directory as the PDF to gain privileges. The vulnerabi...

CVE-2014-3162

Affected software: Chromium/Google Chrome (Chromium browser) as packaged in Debian open repositories and openSUSE updates, specifically around version 36.0.1985.125. Root cause / issue: Multiple vulnerabilities in Chromium with CVE-2014-3162 cited as part of security fixes; Debian notes “the Goog...

CVE-2014-9746

CVE-2014-9746 affects FreeType before 2.5.4. The functions t1_parse_font_matrix (type1/t1load.c), cid_parse_font_matrix (cid/cidload.c), t42_parse_font_matrix (type42/t42parse.c), and ps_parser_load_field (psaux/psobjs.c) do not check return values, enabling potential denial of service via uninit...

CVE-2015-2047

The CVE-2015-2047 issue affects the TYPO3 rsaauth extension. Affected: TYPO3 versions 4.3.0–4.3.14, 4.4.0–4.4.15, 4.5.0–4.5.39, and 4.6.0–4.6.18 when configured for the frontend. Description: remote attackers can bypass authentication by supplying a password cast to an empty value. Impact is an a...

CVE-2015-8971

The CVE-2015-8971 issue affects Terminology (terminal emulator) version 0.7.0, where incorrect sanitising of character escape sequences allows an attacker to execute arbitrary commands by crafting escape sequences that modify the window title and are written to the terminal. Root cause: failure t...

CVE-2016-2849

CVE-2016-2849 affects Botan: the library did not use a constant-time algorithm for modular inverse during ECDSA signing, enabling timing side-channel leakage that could reveal ECDSA secret keys. Affected are Botan versions before 1.10.13 and 1.11.x before 1.11.29. Impact is a remote attacker pote...

CVE-2016-4423

The CVE-2016-4423 issue affects Symfony’s UsernamePasswordFormAuthenticationListener (components: Symfony Security) where the attemptAuthentication function does not bound the maximum length of a username stored in a session. This can be exploited by remote attackers to cause a denial of service ...

CVE-2016-4478

CVE-2016-4478 affects Atheme

CVE-2017-0369

CVE-2017-0369 affects MediaWiki prior to 1.28.1, 1.27.2, and 1.23.16, exposing a flaw where sysops could undelete pages despite protection. Connected sources corroborate the issue across multiple advisories (Fedora/Mageia) and vulnerability trackers, without detailing exploit vectors beyond the u...

CVE-2017-0917

CVE-2017-0917: GitLab Community Edition v10.2.4 vulnerability in the CI job component due to lack of input validation, causing persistent cross-site scripting. Confirmed details across multiple sources indicate a remote attacker could inject arbitrary script via CI job output, leading to potentia...

CVE-2017-12872

CVE-2017-12872 affects SimpleSAMLphp (

CVE-2017-15954

CVE-2017-15954 affects the bchunk package (BinChunker) versions 1.2.0 and 1.2.1. The vulnerability is a heap-based buffer overflow that can cause a crash (and an invalid free) when processing a malformed CUE (.cue) file. Descriptions across multiple sources confirm the issue and its association w...

CVE-2017-16852

CVE-2017-16852 affects Shibboleth Service Provider (shibboleth-sp) via the Dynamic MetadataProvider plugin. In versions before 2.6.1, it may misconfigure with MetadataFilter plugins and skip critical checks such as signature verification and validity period enforcement, among other deployment-spe...

CVE-2017-17843

The CVE-2017-17843 issue affects Enigmail before 1.9.9, where incorrect regular expressions used to extract an e-mail address from a comma-separated list can cause the intended public key to be used for encryption. Connected sources corroborate this as part of a set of vulnerabilities fixed in Th...

CVE-2017-18121

CVE-2017-18121 affects SimpleSAMLphp’s consentAdmin module (up to version 1.14.15); it enables cross-site scripting via crafted links that execute arbitrary JavaScript in the victim’s browser. Debian advisories and Nessus plugins indicate fixes were released (e.g., 1.14.11-1+deb9u1 for Stretch, 1...

CVE-2017-6310

CVE-2017-6310 is a tnef vulnerability describing four type confusions in file_add_mapi_attrs() that can lead to invalid read/write operations (pre-1.4.13). Connected advisories confirm this alongside related CVEs and note fixes in Debian Jessie/Wheezy releases: upgrading to tnef 1.4.9-1+deb7u1 (a...

CVE-2017-8814

CVE-2017-8814 affects MediaWiki language converter. Versions affected: before 1.27.4, before 1.28.3 in 1.28.x, and before 1.29.2 in 1.29.x. The vulnerability allows replacing text inside tags via a rule definition followed by a large amount of junk. Remediation across sources points to upgrading ...

CVE-2017-8820

CVE-2017-8820 : In Tor up to upstream fixes, a remote attacker could crash a directory authority via a malformed router descriptor, causing a NULL pointer dereference and DoS. Affected releases include several 0.2.x, 0.3.0.x (pre-0.3.0.13) and 0.3.1.x pre-0.3.1.9. Upstream remediation is to upgra...

CVE-2017-8849

CVE-2017-8849 affects smb4k, a KDE SMB/CIFS share browser. A logic flaw in the mount helper binary (typically installed setuid) may allow a local user to execute arbitrary commands as root by abusing mount command handling. Public advisories (Debian DSA-3951-1, Mageia, Gentoo GLSA, Fedora package...

CVE-2018-1000528

CVE-2018-1000528 affects GONICUS GOsa prior to commit 56070d6289d47ba3f5918885954dcceb75606001. The XSS flaw is in the change password form (html/password.php, #308), allowing injection of arbitrary script/HTML when a user views a specially crafted page. Attack requires victim interaction (openin...

CVE-2018-10859

git-annex (CVE-2018-10859) is vulnerable to Information Exposure when decrypting files. A malicious server on a special remote could trick git-annex into decrypting data encrypted to the user’s gpg key, exposing encrypted data not stored in git-annex. Public advisories show fixes in git-annex aro...

CVE-2018-11504

The CVE-2018-11504 issue affects the DISCOUNT Markdown parser (DISCOUNT 2.2.3a) specifically the islist function in markdown.c within libmarkdown.a, allowing a crafted file to trigger a heap-based buffer over-read and cause a denial of service. Public advisories in connected documents confirm the...

CVE-2018-20431

CVE-2018-20431 is a NULL pointer dereference in GNU Libextractor

CVE-2018-6358

CVE-2018-6358 is a heap-based buffer overflow in the Ming library (printDefineFont2 in util/listfdb.c) up to version 0.4.8, potentially enabling denial of service or other effects via a crafted FDB file. Connected sources confirm Ming (libming) up to 0.4.8 is affected and document related issues ...

CVE-2018-7870

CVE-2018-7870 concerns libming 0.4.8, where an invalid memory address dereference in getString (util/decompile.c) for CONSTANT16 data can cause a segmentation fault and application crash, leading to denial of service. Connected advisories confirm this affects the ming library and indicate that fi...

CVE-2018-9989

CVE-2018-9989 affects ARM mbed TLS pre-2.1.11, pre-2.7.2, and pre-2.8.0, with a buffer over-read in ssl_parse_server_psk_hint() that could cause a crash on invalid input. The issue is documented across multiple advisories; Debian LTS/DLA-2826 notes fixes in mbedtls 2.4.2-1+deb9u4 for Debian 9, an...

CVE-2020-28619

CGAL CGAL-5.1.1 Nef polygon-parsing vulnerabilities exist (out-of-bounds read and type confusion) that could lead to code execution when processing crafted input. The issue is reported across numerous CVEs (e.g., CVE-2020-28619 and related CNEs in the Nef_S2/SNC_io_parser.h read_edge() and other ...

CVE-2020-28630

CVE-2020-28630 is part of CGAL 5.1.1 Nef polygon-parsing vulnerabilities. The connected sources confirm an out-of-bounds (OOB) read in SNC_io_parser.h (read_sedge) that can lead to code execution when processing crafted CGAL Nef data. Affected software is CGAL libcgal CGAL-5.1.1; exploitation rel...

CVE-2021-21836

CVE-2021-21836 concerns the GPAC Project on Advanced Content library (GPAC) v1.0.1. The vulnerability is a heap-based buffer overflow triggered by an exploitable integer overflow in the MPEG-4 decoding path when processing the ctts atom/FOURCC, due to unchecked arithmetic. This can lead to memory...

CVE-2021-23225

CVE-2021-23225 (Cacti 1.1.38) : An authenticated user with User Management permissions can inject arbitrary web script or HTML in the “new_username” field when creating a new user via the Copy method in user_admin.php. The vulnerability’s impact is described as cross-site scripting (XSS). Debian'...

CVE-2021-36055

CVE-2021-36055 affects Exempi (XMP Toolkit SDK) up to version 2020.1 and earlier, with a use-after-free that could allow arbitrary code execution under the current user when a victim opens a crafted file. Several advisories document the issue across distros and provide patches: Debian bullseye 2....

CVE-2022-43596

OpenImageIO CVE-2022-43596 is an information-disclosure flaw in the IFFOutput channel interleaving of OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can leak heap data. Multiple connected advisories confirm the affected library and provide remediation guidance: Debian DSA-5384/DSA-5...

CVE-2022-44641

Summary: CVE-2022-44641 concerns LAVA (Linaro Automated Validation Architecture) where a user with valid credentials can submit crafted XMLRPC requests that trigger recursive XML entity expansion, causing memory exhaustion on the server and resulting in a Denial of Service. Impact and scope: The ...

CVE-2023-24756

CVE-2023-24756 affects libde265 v1.0.10 with a NULL pointer dereference in the ff_hevc_put_unweighted_pred_8_sse function (sse-motion.cc), enabling Denial of Service via crafted input files. Debian’s DLA-3352-1 notes a fix to v1.0.11; Mageia also references an updated libde265 (v1.0.11). Other co...

CVE-2025-38666

CVE-2025-38666 is a Linux kernel vulnerability in the Appletalk AARP proxy path. The issue is a use-after-free caused by a race: the aarp_proxy_network path releases aarp_lock, sleeps, re-acquires it, while a concurrent __aarp_expire_timer may remove and free the same aarp_entry, leading to a UAF...

CVE-2025-38671

CVE-2025-38671 affects the Linux kernel i2c: qup driver. Root cause: timeout handling only set a return value and did not exit the loop when a client keeps the bus active, enabling kernel hang (observed with PCA953x GPIO extender). Fix: change the logic to return via -ETIMEDOUT, jumping out of th...

CVE-2000-0314

CVE-2000-0314 affects NetBSD 1.3.3 and Linux where traceroute with a large waittime (-w) is not parsed correctly, causing the time delay for sending packets to be zero. This can enable local users to flood other systems. The description covers the affected vectors and impact as stated; no explici...

CVE-2000-1221

The CVE describes a vulnerability in the line printer daemon (lpd) in the lpr package across multiple Linux operating systems. The root cause is an authentication check that compares the reverse-resolved hostname of the local machine to the hostname returned by gethostname; remote attackers can b...