CVE-2020-14781

CVE-2020-14781 affects Oracle Java SE/SE Embedded (JNDI) with affected versions including Java SE 7u271, 8u261, 11.0.8, 15 and Java SE Embedded 8u261. The vulnerability allows an unauthenticated attacker with network access via multiple protocols to read a subset of Java SE/SE Embedded data. The ...

CVE-2021-21345

CVE-2021-21345 affects the XStream Java library. Per connected sources, vulnerable versions are those before 1.4.16, where an attacker with sufficient rights can remotely execute commands on the host by manipulating the processed input stream. The issue is mitigated by upgrading to 1.4.16 or late...

CVE-2021-23134

CVE-2021-23134 is a Linux kernel NFC LLCP use-after-free in nfc sockets (pre-5.12.4). The issue arises from refcount handling during bind/connect fixes, enabling a local attacker with CAP_NET_RAW to trigger a crash or memory corruption. A related CVE discussion confirms the fix: after nfc_llcp_lo...

CVE-2016-0728

The CVE-2016-0728 issue affects the Linux kernel up to version 4.4.1, specifically in the keyring handling path join_session_keyring() within security/keys/process_keys.c. A flaw in object reference management in an error path can allow a local, unprivileged user to escalate privileges or cause a...

CVE-2018-5712

Summary: CVE-2018-5712 is a PHP vulnerability caused by a reflected XSS on the PHAR 403/404 error pages. Affected versions include PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. The issue arises from how the PHAR-related error pages incorporate URI data from ...

CVE-2019-15926

CVE-2019-15926 targets the Linux kernel up to version 5.2.2, with an out-of-bounds access in the Marvell/ ath6kl wireless driver: the functions ath6kl_wmi_pstream_timeout_event_rx and ath6kl_wmi_cac_event_rx in drivers/net/wireless/ath/ath6kl/wmi.c. The connected Nessus entries confirm the flaw e...

CVE-2019-20218

CVE-2019-20218 affects SQLite: in selectExpander (select.c) the WITH stack unwinding continues after a parsing error, potentially causing an application crash. The issue is confirmed across multiple advisories (Debian LTS/DLA entries, Gentoo GLSA, AlmaLinux advisory, Cloud Foundry USN) and is lis...

CVE-2020-11112

CVE-2020-11112 affects FasterXML jackson-databind 2.x before 2.9.10.4, where serialization gadgets and typing interaction is mishandled (related to org.apache.commons.proxy.provider.remoting.RmiProvider). This is a deserialization issue that could enable malicious payload execution; affected prod...

CVE-2020-13630

CVE-2020-13630 affects SQLite prior to 3.32.0, with a use-after-free in ext/fts3/fts3.c (fts3EvalNextRow) related to the snippet feature. Multiple connected advisories (Astra Linux, BSA, AlmaLinux) confirm the issue in SQLite and reference the same function/file. The provided sources do not quant...

CVE-2022-24713

CVE-2022-24713 affects the Rust regex crate. A bug in the mitigations for untrusted regexes may allow denial-of-service via specially crafted regexes executed against user-controlled input. All versions ≤ 1.5.4 are affected; the fix starts with regex 1.5.5. Upgrading to a newer regex crate versio...

CVE-2022-29900

CVE-2022-29900 describes mis-trained branch predictions for return instructions that may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions. Connected advisories confirm this affects Linux-kernel components (e.g., linux-5.10 in Astra Linux; multiple Am...

CVE-2025-21490

CVE-2025-21490 affects Oracle MySQL Server (InnoDB) with vulnerable versions including MySQL 8.0.40 and earlier, 8.4.3 and earlier, and 9.1.0 and earlier. Attacker with network access via multiple protocols and high privileges can cause a hang or complete DoS on MySQL Server. Connected advisories...

CVE-2012-3163

CVE-2012-3163 affects the MySQL Server component in Oracle MySQL 5.1.64 and earlier and 5.5.26 and earlier. It is described as an unspecified vulnerability that remote authenticated users can exploit via unknown vectors related to Information Schema, impacting confidentiality, integrity, and avai...

CVE-2018-16865

CVE-2018-16865 affects systemd-journald (journald) and was described across multiple sources as a memory-allocation/stack-clash vulnerability. The issue occurs when many entries are sent to the journal socket (or via remote journald-remote) and can allow crash or code execution. Affected versions...

CVE-2019-20503

CVE-2019-20503 is an out-of-bounds read in usrsctp’s sctp_load_addresses_from_init. Connected documents confirm affected components (libusrsctp/usrsctp) and indicate versions prior to 0.9.5.0-1 are vulnerable (Mariner packages). A patched version (0.9.5.0-1 or later) is available, per CBLMariner ...

CVE-2020-8608

In libslirp 4.1.0 (as used in QEMU 4.2.0), tcp_subr.c misuses snprintf return values, causing a buffer overflow in later code. Debian advisories state this can lead to denial of service or potentially arbitrary code execution; upstream and distribution advisories (e.g., Debian DSA-4733-1, ALAS-20...

CVE-2021-21346

XStream (Java XML serialization library) has CVE-2021-21346 among a set of 2021-04x vulnerabilities. The issue affects XStream prior to 1.4.16 where processing input streams can lead to remote code execution or related impacts if exploitation occurs, with mitigations including enabling the Securi...

CVE-2021-22959

CVE-2021-22959 relates to HTTP Request Smuggling in the llhttp parser when a space follows a header name before the colon. Affected llhttp versions are < v2.1.4 and

CVE-2022-2048

CVE-2022-2048 concerns the Eclipse Jetty HTTP/2 server. The bug occurs when handling an invalid HTTP/2 request, where the error path fails to properly clean up active connections and associated resources. This can lead to a denial of service due to resource exhaustion, rendering the server unable...

CVE-2022-21248

CVE-2022-21248 affects Oracle Java SE and GraalVM Enterprise Edition via the Serialization component. Affected Oracle Java SE versions: 7u321, 8u311, 11.0.13, 17.0.1; GraalVM Enterprise Edition: 20.3.4 and 21.3.0. The vulnerability is exploitable over the network and allows an unauthenticated att...

CVE-2016-4450

CVE-2016-4450 – nginx denial of service via NULL pointer dereference . Affects nginx before 1.10.1 and 1.11.x before 1.11.1 when saving the client request body to a temporary file. A crafted request can crash a worker process, causing DoS. The underlying issue is a NULL pointer dereference in cod...

CVE-2018-14553

CVE-2018-14553 affects libgd2’s gdImageClone in gd.c (libgd versions 2.1.0-rc2 through 2.2.5). The vulnerability is a NULL pointer dereference that can crash an application; impact is a denial of service and it occurs when PHP is linked against an external libgd (not the bundled one). Affected ad...

CVE-2019-15292

CVE-2019-15292 is a vulnerability in the Linux kernel before 5.0.9 involving a use-after-free in the Appletalk subsystem (atalk_proc_exit), related to the files net/appletalk/atalk_proc.c, net/appletalk/ddp.c, and net/appletalk/sysctl_net_atalk.c. The issue is documented in multiple connected Nes...

CVE-2019-15538

CVE-2019-15538 affects the Linux kernel component fs/xfs/xfs_iops.c: xfs_setattr_nonsize, with the issue present in kernels up to 5.2.9. The vulnerability arises when a chgrp operation fails due to out-of-disk-quota conditions, causing XFS to partially wedge and fail to unlock ILOCK after the xfs...

CVE-2019-20041

CVE-2019-20041: In WordPress, wp-includes/kses.php mishandles the HTML5 colon named entity (e.g., javascript:), allowing bypass of input sanitization on WordPress versions before 5.3.1. This is triggered by the javascript: substring example and constitutes an input-sanitization bypass in the kses...

CVE-2019-20444

CVE-2019-20444: Netty HttpObjectDecoder allows a header without a colon, enabling possible HTTP request smuggling/invalid fold. Affected: IBM StreamSets Data Collector 5.0.0–6.4.1 (per IBM bulletin). Root cause: HttpObjectDecoder handling of malformed headers. Remediation (documented): upgrade to...

CVE-2020-14581

CVE-2020-14581 affects Oracle Java SE/Java SE Embedded (component: 2D) with affected versions Java SE: 8u251, 11.0.7, 14.0.1 and Java SE Embedded: 8u251. The CVE is listed with a low overall base score (CVSS 3.1: 3.7) and confidentiality impact (C:L) and no impact on integrity/availability (I:N/A...

CVE-2020-8647

Summary of CVE-2020-8647: A use-after-free? No — it is an MMIO out-of-bounds access in the vgacon driver (vt.c, vc_do_resize) of the Linux kernel, reported in the Debian/AlmaLinux advisories as CVE-2020-8647. Impact stated in Debian entries includes potential denial of service, memory corruption,...

CVE-2021-43976

CVE-2021-43976 affects the Linux kernel, specifically the Marvell mwifiex_usb_recv() function in drivers/net/wireless/marvell/mwifiex/usb.c. A local attacker with access to a crafted USB device can trigger a denial of service (skb_over_panic). The advisory notes the vulnerability exists in kernel...

CVE-2021-44716

CVE-2021-44716 affects Go's net/http implementation: before Go 1.16.12 and 1.17.x before 1.17.5, HTTP/2 header canonicalization can cause uncontrolled memory consumption. The vulnerability is rooted in the header cache behavior. Multiple connected advisories indicate that upgrades resolve the iss...

CVE-2022-21299

CVE-2022-21299 is reported across multiple feeds as affecting Oracle Java SE and GraalVM Enterprise Edition, involving several components (JAXP, Serialization, Libraries, ImageIO, Hotspot, 2D). Affected Java SE versions include 7u321, 8u311, 11.0.13, 17.0.1; GraalVM EE versions 20.3.4 and 21.3.0....

CVE-2023-2255

Summary (CVE-2023-2255) : LibreOffice prior to 7.4.7 and 7.5.x prior to 7.5.3 suffers from improper access control in editor components, enabling a document to cause external links via floating frames to load content without user prompt. Multiple connected sources (Debian DSA-5415-1, Debian DLA-3...

CVE-2018-16841

CVE-2018-16841 affects Samba AD DC KDC when PKINIT is used. The root cause is a double-free: talloc_free() is called twice on the same memory after an auth mismatch, causing the KDC to abort and thus a denial of service. Affected versions include Samba 4.3.0 and earlier and certain 4.7.x/4.8.x/4....

CVE-2019-14902

CVE-2019-14902 affects Samba: all 4.11.x before 4.11.5, all 4.10.x before 4.10.12, and all 4.9.x before 4.9.18. The issue is that removal of the right to create or modify a subtree would not automatically be taken away on all domain controllers. Impact is exposure of ACL/permission state across A...

CVE-2020-29443

CVE-2020-29443 affects QEMU, specifically the ATAPI read path: ide_atapi_cmd_reply_end in hw/ide/atapi.c. The underlying issue is an unvalidated buffer index, causing out-of-bounds read access. Documented impact is host QEMU process reliability risk (potential crash) due to this condition. Multip...

CVE-2016-7117

CVE-2016-7117 describes a use-after-free in the Linux kernel’s __sys_recvmmsg() within net/socket.c, affecting kernel versions prior to 4.5.2. An attacker could trigger the corruption via a mishandled recvmmsg system call during error processing, enabling remote execution of arbitrary code. The v...

CVE-2019-9213

CVE-2019-9213 : Linux kernel mmap minimum address check in mm/mmap.c is insufficient, enabling a NULL pointer dereference exploit on platforms without SMAP/PAN. Affected: kernels before 4.20.14. Mitigation: upgrade to 4.20.14 or later (see ChangeLog-4.20.14; USN-3931-2).

CVE-2021-35567

CVE-2021-35567 affects Oracle Java SE and GraalVM Enterprise Edition libraries; root cause is incorrect principal selection when Kerberos Constrained Delegation is used. Affected: Java SE 8u301, 11.0.12, 17 and GraalVM EE 20.3.3/21.2.0 (Libraries component). Impact includes potential unauthorized...

CVE-2023-22036

CVE-2023-22036 is described across the primary record as vulnerability in Oracle Java SE, GraalVM (Utility) with affected versions across Oracle Java SE 11.0.19, 17.0.7, 20.0.1 and GraalVM 20.3.10, 21.3.6, 22.3.2; attackable by unauthenticated network access via multiple protocols, potentially en...

CVE-2024-29025

Netty CVE-2024-29025 affects the HttpPostRequestDecoder: an attacker can craft a chunked POST with many small fields to cause unbounded data accumulation in bodyListHttpData and undecodedChunk, potentially exhausting resources. The issue is mitigated by upgrading Netty to 4.1.108.Final or later. ...

CVE-2020-25643

CVE-2020-25643 affects the Linux kernel HDLC_PPP module via improper input validation in ppp_cp_parse_cr, causing memory corruption and a read overflow that can lead to system crash or DoS. Public advisories confirm this vulnerability and reference the same root cause, with mitigations proposed a...

CVE-2022-21496

CVE-2022-21496 affects Oracle Java SE and Oracle GraalVM Enterprise Edition across multiple components (JNDI, JAXP, Libraries, Hotspot) with listed affected versions. The vulnerability enables network-accessible, unauthenticated attackers to modify or access data (integrity/availability impacts) ...

CVE-2023-52160

CVE-2023-52160 – wpa_supplicant PEAP bypass : The issue occurs in the PEAP implementation through wpa_supplicant up to version 2.10, allowing an authentication bypass when Phase 1 TLS certificate verification is disabled. An attacker can abuse an eap_peap_decrypt vulnerability and send an EAP-TLV...

CVE-2020-2754

CVE-2020-2754 affects Oracle Java SE/Embedded (Scripting) with affected versions Java SE 8u241, 11.0.6 and 14; Java SE Embedded 8u241. Root cause: a parsing/validation weakness in the Scripting component allows an unauthenticated, network-based attacker to cause a partial Denial of Service on Jav...

CVE-2020-7919

The CVE-2020-7919 issue affects Go before 1.12.16 and Go 1.13.x before 1.13.7, including the crypto/cryptobyte package (0.0.0-20200124225646-8b5121be2f68). A malformed X.509 certificate can cause a panic in clients, enabling denial-of-service conditions. In practice, Helm advisories note Go 1.14....

CVE-2023-23455

CVE-2023-23455 affects the Linux kernel’s ATM traffic control path: atm_tc_enqueue in net/sched/sch_atm.c up to version 6.1.4 is vulnerable to a type confusion that can misclassify values, enabling a local denial-of-service. Public reports describe the issue without details on exploits beyond DoS...

CVE-2024-25126

Rack (Ruby) is affected by CVE-2024-25126, a Denial of Service caused by pathological parsing of Content-Type headers in Rack’s media type parser. The issue is disclosed across multiple advisories and is addressed by patches in Rack versions 3.0.9.1 and 2.2.8.1. In connected advisories, related D...

CVE-2018-7750

CVE-2018-7750 affects Paramiko’s SSH server transport.py: before fixes, it did not verify that authentication completed before processing other requests (e.g., channel-open), enabling a customized SSH client to bypass authentication. Affected series include 1.17.6 and earlier in 1.x, 1.18.x befor...

CVE-2019-11840

CVE-2019-11840 affects golang.org/x/crypto (amd64 salsa20 and salsa20/salsa). If keystream surpasses 256 GiB or the counter grows beyond 32 bits, output becomes incorrect and then repeats earlier keystream, causing potential confidentiality loss in encryption/CSPRNG. The connected Debian advisory...

CVE-2020-14779

CVE-2020-14779 affects Oracle Java SE SE/Embedded with Serialization and can enable an unauthenticated network-based attacker to cause partial denial of service. Affected versions include Java SE 7u271, 8u261, 11.0.8, 15 and Java SE Embedded 8u261; attack surface covers client and server deployme...