CVE-2020-10673

CVE-2020-10673 affects FasterXML jackson-databind 2.x prior to 2.9.10.4. The IBM bulletin and the consolidated Jira/Advisory in connected docs describe a deserialization issue where interaction between serialization gadgets and typing (related to com.caucho.config.types.ResourceRef, aka caucho-qu...

CVE-2020-13112

Concisely: CVE-2020-13112 affects libexif prior to 0.6.22, caused by several buffer over-reads in EXIF MakerNote handling that could lead to information disclosure and crashes. Multiple connected advisories (ALAS2-2020-1523/1393, ALAS-2020-1443, CESA/CentOS/RH advisories, Debian LTS) corroborate ...

CVE-2020-24586

CVE-2020-24586 describes a fragmentation cache issue in the Linux kernel Wi‑Fi stack: received fragments are not cleared from memory on reconnect, enabling an attacker within Wi‑Fi range to inject arbitrary packets or exfiltrate data when fragments encrypted with WEP/CCMP/GCMP are involved. Conne...

CVE-2020-5208

CVE-2020-5208 affects ipmitool before 1.8.19. Multiple functions in ipmitool neglected proper validation of data, which may cause buffer overflows and potentially remote code execution when ipmitool runs with elevated privileges. The issue is documented across multiple advisories and is stated to...

CVE-2019-19523

CVE-2019-19523 affects the Linux kernel prior to 5.3.7, where a use-after-free can be caused by a malicious USB device via the drivers/usb/misc/adutux.c driver (CID-44efc269db79). Affected systems include distributions referenced in accompanying advisories (e.g., MiracleLinux 8, Unity Linux 20.x)...

CVE-2019-5068

CVE-2019-5068 affects X11 Mesa 3D Graphics Library, specifically version 19.1.2, with an exploitable shared memory permissions vulnerability that allows an attacker to access shared memory locally. The issue is addressed in vendor advisories (e.g., SUSE-SU-2021:3117-1) and OSV entries indicating ...

CVE-2020-14195

CVE-2020-14195 affects FasterXML jackson-databind 2.x before 2.9.10.5, where deserialization gadgets/typing interaction can be exploited (related to org.jsecurity JndiRealmFactory) to potentially execute code. IBM X-Force lists a base score of 9.8 with HIGH impact on confidentiality, integrity an...

CVE-2020-1968

CVE-2020-1968 describes the Raccoon attack on TLS DH ciphersuites, where re-use of a DH secret allows an attacker to compute the pre‑master secret and eavesdrop on the TLS connection. Affected: OpenSSL 1.0.2 (downstreamly out of public updates) with affected range 1.0.2-1.0.2v. OpenSSL 1.1.1 is n...

CVE-2020-25722

CVE-2020-25722 affects Samba AD DC and concerns inadequate access and conformance checking of stored data, potentially enabling total domain compromise. Public references in multiple feeds confirm the impact on Samba AD DC and that affected packages (e.g., Samba) require upgrading. Debian advisor...

CVE-2021-3679

CVE-2021-3679 affects the Linux kernel tracing subsystem (trace ring buffer) prior to 5.14-rc3. The flaw arises in how a user uses the trace ring buffer, enabling a privileged local attacker (CAP_SYS_ADMIN) to starve CPU resources and cause denial of service. The connected documents consistently ...

CVE-2022-35256

CVE-2022-35256 concerns the llhttp parser used by Node.js (http module) where header fields not terminated with CRLF can enable HTTP Request Smuggling. The issue is present in Node.js builds that include the llhttp version affected and has been addressed by package updates in multiple distributio...

CVE-2020-5504

CVE-2020-5504 affects phpMyAdmin 4 prior to 4.9.4 and 5 prior to 5.0.1, where an SQL injection exists in the user accounts page. A malicious user could inject SQL in place of their username when creating queries on that page; an attacker must have a valid MySQL account to access the server. Conne...

CVE-2021-21351

CVE-2021-21351 is an XStream deserialization vulnerability. Connected IBM advisories confirm the issue affects IBM Data Risk Manager (IDRM) and IBM Engineering/Test Management products via bundled XStream versions, with exploitation through unmarshalling to achieve arbitrary code execution. Remed...

CVE-2022-29824

Summary: CVE-2022-29824 affects libxml2 up to version 2.9.14. Several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) fail to check integer overflows, causing out-of-bounds memory writes when processing crafted XML files. This vulnerability also affects software that uses lib...

CVE-2017-12163

CVE-2017-12163 is an information-leak in Samba SMB1 processing that can enable a malicious client to dump server memory to a file on a Samba share or a shared printer. Affected: Samba prior to 4.4.16 (4.5.x before 4.5.14, 4.6.x before 4.6.8). Impact: partial confidentiality of memory; exact memor...

CVE-2019-14861

CVE-2019-14861 affects Samba when acting as an AD DC; DNS records stored in LDAP could be misread if a DNS record name case-insensitively matched a zone name, caused by ldb_qsort()/dns_name_compare() during DnssrvEnumRecords() responses. Affected are Samba 4.x prior to 4.9.17 (4.9.x), 4.10.x prio...

CVE-2020-13401

Docker Engine vulnerability CVE-2020-13401: before 19.03.11, a container process with CAP_NET_RAW can craft IPv6 router advertisements via the bridge/network setup, enabling spoofing of external IPv6 hosts, potential information disclosure, or denial of service. Several connected advisories confi...

CVE-2021-22946

CVE-2021-22946 affects curl before 7.82.0 (and within 7.20.0–7.78.0 per description) where the --ssl-reqd option or CURLUSESSL controls could be bypassed if a server crafts a legitimate response, allowing curl to continue without TLS. Connected sources confirm this flaw exists across multiple eco...

CVE-2023-3772

CVE-2023-3772 is a Linux kernel vulnerability in the IPsec XFRM subsystem that allows a local attacker with CAP_NET_ADMIN to dereference a NULL pointer in xfrm_update_ae_params(), potentially crashing the kernel and causing a denial of service. Connected documents confirm the root cause as a NULL...

CVE-2023-43641

CVE-2023-43641 affects libcue, a library for parsing CUE sheets. Versions

CVE-2016-10165

CVE-2016-10165 targets Little CMS (lcms2). The Type_MLU_Read function in cmstypes.c may trigger an out-of-bounds heap read when processing a crafted ICC profile, potentially allowing information disclosure or denial of service. Connected IBM advisories confirm the vulnerability details for produc...

CVE-2018-3214

CVE-2018-3214 affects Oracle Java SE components (Sound, JRockit, JSSE, JNDI, Networking) across Java SE 6u201/7u191/8u182, Java SE Embedded 8u181, and JRockit R28.3.19. Descriptions indicate unauthenticated network access could lead to partial DOS, data exposure or data modification depending on ...

CVE-2019-15221

CVE-2019-15221 affects the Linux kernel up to version 5.1.17. A NULL pointer dereference can be triggered by a malicious USB device via the sound/usb/line6/pcm.c driver, leading to denial of service or system instability. Affected component is the kernel sound USB Line6 PCM driver; root cause is ...

CVE-2020-7788

CVE-2020-7788 affects the ini package before 1.3.6. An attacker can submit a malicious INI file parsed by ini.parse, polluting the application’s prototype and potentially enabling further exploitation depending on context. Remediation: upgrade to ini 1.3.6 or newer.

CVE-2011-2688

The Apache HTTP Server is vulnerable to a SQL injection in the mod_authnz_external module (specifically the mysql/mysql-auth.pl script) in version 3.2.5 and earlier . The root cause is the failure to properly sanitize input before using it in an SQL query. A remote attacker can exploit this by pr...

CVE-2011-4862

A buffer overflow exists in libtelnet/encrypt.c within telnetd affecting FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, and GNU inetutils . This vulnerability allows remote attackers to execute arbitrary code by providing a l...

CVE-2021-20322

CVE-2021-20322 relates to a Linux kernel ICMP handling flaw (ICMP fragment needed/redirect) that lets an off-path attacker quickly discover UDP port usage, bypassing UDP source port randomization. The connected advisories confirm this affects the Linux kernel and multiple distributions and mentio...

CVE-2019-14275

CVE-2019-14275 affects Xfig’s fig2dev, specifically a stack-based buffer overflow in the calc_arrow function of bound.c (v3.2.7a). This leads to potential denial-of-service conditions as noted in multiple advisories. The issue is addressed in newer fig2dev releases (fixed in 3.2.8; OpenVAS/Ubuntu...

CVE-2020-8231

CVE-2020-8231 affects libcurl/curl: a dangling pointer could cause the library to use the wrong connection when CURLOPT_CONNECT_ONLY is set, potentially leading to information leaks. Public references in the provided connected docs show affected curl/libcurl versions ranging from 7.29.0 through 7...

CVE-2021-33196

CVE-2021-33196 affects Go’s standard library archive/zip. A crafted archive header can cause a panic in NewReader/OpenReader when parsing the header’s file count, with related follow‑ups noting an incomplete fix (CVE-2021-39293). The issue originates from Go releases prior to 1.15.13 and 1.16.x p...

CVE-2021-46784

The CVE-2021-46784 issue affects Squid 3.x–3.5.28, 4.x–4.17, and 5.x prior to 5.6, caused by improper buffer management that can lead to a Denial of Service when processing long Gopher server responses. Affected releases are vulnerable to DoS; remediation is to update to a fixed version (5.6 or l...

CVE-2024-32465

Git vulnerability CVE-2024-32465 affects local-cloning scenarios and can allow arbitrary code execution when cloning repositories from untrusted sources. Astra Linux documents indicate affected Git before 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, with patches in 2.45.1, 2.44.1, ...

CVE-2018-3180

CVE-2018-3180 is an Oracle Java SE/Embedded/JRockit vulnerability disclosed across multiple advisories. The connected documents confirm affected products and components and provide concrete impact scopes: vulnerable are OpenJDK/OpenJDK-based builds of Java SE/Embedded and related JSSE/JNDI/Hotspo...

CVE-2021-37137

CVE-2021-37137 involves Netty’s Snappy frame decoding where the SnappyFrameDecoder does not restrict the chunk length, enabling potential excessive memory usage. The issue can be triggered by crafted input that decompresses to a very large size (via network streams or files) or by sending a very ...

CVE-2021-37750

CVE-2021-37750 is a vulnerability in MIT Kerberos 5 (krb5) where the Key Distribution Center (KDC) can suffer a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field. Affected releases include krb5 before 1.18.5 and 1.19.x before 1.19.3. The issue can cause ...

CVE-2019-20330

CVE-2019-20330 affects FasterXML jackson-databind 2.x before 2.9.10.2, which lacks blocking for net.sf.ehcache in deserialization. This is a deserialization-side issue with high–critical impact potential; remediation is to upgrade to jackson-databind 2.9.10.2 or newer as indicated by connected IB...

CVE-2019-3863

In CVE-2019-3863, libssh2 (SSH client library) is vulnerable to an out-of-bounds memory write when a server sends multiple keyboard-interactive responses whose total length exceeds the unsigned char max. This is triggered during keyboard-interactive handling, using the excessive total length as a...

CVE-2019-9278

CVE-2019-9278 affects libexif. The vulnerability is an out-of-bounds write caused by an integer overflow in libexif, leading to remote escalation of privilege in the media content provider. Exploitation requires user interaction. Affected versions include Android-10 (and related platforms in the ...

CVE-2021-21230

The CVE-2021-21230 issue affects Google Chrome’s V8 component due to a type confusion vulnerability, fixed in Chrome before 90.0.4430.93. Multiple connected sources (Debian security advisory DSA-4911-1, Alpine security page, Astra Linux bulletin, and other trackers) confirm the same root cause: i...

CVE-2020-14355

Summary of CVE-2020-14355 : Multiple buffer overflow vulnerabilities were found in the QUIC image decoding path of SPICE, affecting both client and server components (spice-gtk, spice-server, and shared spice-common code). The flaws could allow a remote attacker to send crafted QUIC messages that...

CVE-2021-35942

CVE-2021-35942 affects the GNU C Library (glibc) wordexp in posix/wordexp.c. The root cause is an integer/regex handling issue caused by using atoi instead of strtoul, which can lead to an out-of-bounds read or memory access. Exploitation can crash the process or cause information disclosure (DoS...

CVE-2023-22006

CVE-2023-22006 affects Oracle Java SE (Networking) and GraalVM variants; listed affected versions include Oracle Java SE 11.0.19, 17.0.7, 20.0.1; GraalVM EE 20.3.10, 21.3.6, 22.3.2; GraalVM for JDK 17.0.7 and 20.0.1. The vulnerability is hard to exploit and requires network access via multiple pr...

CVE-2024-20926

CVE-2024-20926 affects Oracle Java SE and related GraalVM products (Scripting component). Affected versions include Oracle Java SE 8u391, 8u391-perf, 11.0.21; GraalVM for JDK 17.0.9; GraalVM Enterprise 20.3.12, 21.3.8, 22.3.4. The vulnerability allows an unauthenticated attacker with network acce...

CVE-2019-20444

CVE-2019-20444: Netty HttpObjectDecoder allows a header without a colon, enabling possible HTTP request smuggling/invalid fold. Affected: IBM StreamSets Data Collector 5.0.0–6.4.1 (per IBM bulletin). Root cause: HttpObjectDecoder handling of malformed headers. Remediation (documented): upgrade to...

CVE-2019-2745

CVE-2019-2745 is an OpenJDK/Java SE vulnerability in the Security subcomponent with affected Java versions including 7u221, 8u212, and 11.0.3. Multiple advisories (CentOS, RHEL/CentOS, Debian) describe this as a side-channel risk in EC cryptography or related OpenJDK components, with exploitation...

CVE-2020-36311

CVE-2020-36311 affects the Linux kernel prior to 5.9. In arch/x86/kvm/svm/sev.c, destroying a large SEV VM (unregistering many encrypted regions) can trigger a denial of service (soft lockup). The connected advisories confirm the issue and point to a fix in kernel 5.9 (and changelog indicating th...

CVE-2016-7401

The CVE describes a CSRF protection bypass in Django caused by the interaction between Google Analytics and Django’s cookie parsing. Affected versions are Django before 1.8.15 and 1.9.x before 1.9.10. Multiple connected advisories confirm the issue and provide remediation guidance: upgrading to a...

CVE-2018-10915

CVE-2018-10915 affects libpq: the PostgreSQL client library may fail to reset internal state between connections, enabling untrusted host/hostaddr parameters to bypass client-side security and potentially enable access to higher-privilege connections or related SQL-injection impacts via PQescape(...

CVE-2020-13143

CVE-2020-13143 affects the Linux kernel USB gadget/configfs (drivers/usb/gadget/configfs.c) from 3.16 to 5.6.13. The flaw arises when gadget_dev_desc_UDC_store uses kstrdup and may encounter an internal NUL value, leading to potential out-of-bounds memory access (reported as heap out-of-bounds wr...

CVE-2020-2590

CVE-2020-2590 is an OpenJDK/Oracle Java SE vulnerability in the Security component (Kerberos interop) affecting Java SE and Java SE Embedded across multiple versions. Public descriptions indicate unauthenticated remote access via network and potential unauthorized data updates/deletes; CVSS 3.0 b...