CVE-2020-8130

CVE-2020-8130 is an OS command injection in Ruby Rake prior to 12.3.3, affecting the Rake::FileList handling of filenames starting with the pipe character |. Root cause: unsafe processing of external input in FileList leads to command execution. Impact: potential arbitrary OS commands if such fil...

CVE-2022-29900

CVE-2022-29900 describes mis-trained branch predictions for return instructions that may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions. Connected advisories confirm this affects Linux-kernel components (e.g., linux-5.10 in Astra Linux; multiple Am...

CVE-2019-19126

CVE-2019-19126 affects glibc on x86-64 where LD_PREFER_MAP_32BIT_EXEC is not ignored after a security transition, enabling local attackers to bypass ASLR on setuid binaries by narrowing library address mappings. Public sources in Connected documents confirm the issue exists in glibc versions befo...

CVE-2019-9213

CVE-2019-9213 : Linux kernel mmap minimum address check in mm/mmap.c is insufficient, enabling a NULL pointer dereference exploit on platforms without SMAP/PAN. Affected: kernels before 4.20.14. Mitigation: upgrade to 4.20.14 or later (see ChangeLog-4.20.14; USN-3931-2).

CVE-2020-14593

CVE-2020-14593 is a vulnerability in the 2D component of Oracle Java SE/SE Embedded. Affected: Java SE 7u261, 8u251, 11.0.7, 14.0.1; Java SE Embedded 8u251. Vulnerability type is unspecified in the provided sources, but exploitation is described as unauthenticated with network access via multiple...

CVE-2021-23133

CVE-2021-23133 is a race condition in the Linux kernel SCTP sockets (net/sctp/socket.c) prior to 5.12-rc8. If sctp_destroy_sock executes without sock_net(sk)->sctp.addr_wq_lock, an element is removed from the auto_asconf_splist list without proper locking, enabling a local attacker with networ...

CVE-2021-27135

CVE-2021-27135 affects the xterm terminal emulator. A crafted sequence of combining UTF-8 characters can cause an out-of-bounds write, potentially enabling arbitrary code execution or denial of service. Affected versions include xterm prior to the patch/fix; multiple vendor advisories note a fix ...

CVE-2021-28660

CVE-2021-28660 affects the Realtek RTL8188EU WiFi driver (drivers/staging/rtl8188eu/os_dep/ioctl_linux.c) in the Linux kernel and is caused by writing beyond the end of the ssid[] array in rtw_wx_set_scan. The Connected documents confirm this exact issue across multiple advisories (e.g., Debian L...

CVE-2021-35556

CVE-2021-35556 is a vulnerability in the Swing component of Java SE (and related GraalVM Enterprise Edition versions) affecting Java SE 7u311, 8u301, 11.0.12, 17 and GraalVM EE 20.3.3/21.2.0. An unauthenticated attacker with network access via multiple protocols can potentially exploit this to ca...

CVE-2021-46848

CVE-2021-46848 affects GNU libtasn1 prior to 4.19.0, due to an off-by-one array size check in the ETYPE_OK path that can impact ASN.1 DER encoding (asn1_encode_simple_der). Public details in connected sources indicate vulnerable versions are

CVE-2022-28388

CVE-2022-28388 affects the Linux kernel driver usb_8dev_start_xmit (drivers/net/can/usb/usb_8dev.c). The vulnerability is a double free in the function usb_8dev_start_xmit, present up to kernel versions including 5.17.1. Documents reference a commit addressing the issue and mention downstream adv...

CVE-2022-3028

CVE-2022-3028 describes a race condition in the Linux kernel’s IP framework (XFRM) where concurrent calls to xfrm_probe_algs can cause an out-of-bounds read that may be copied into a socket, or an out-of-bounds write, enabling a local attacker to leak kernel memory or crash the kernel. Connected ...

CVE-2019-2973

CVE-2019-2973 is an issue in Oracle Java SE/Java SE Embedded (component: JAXP) affecting OpenJDK/OpenJDK builds such as 7u231, 8u221, 11.0.4 and 13 (and Embedded 8u221). The vulnerability allows unauthenticated network-accessed exploitation that can cause a partial denial of service in Java SE/SE...

CVE-2019-3824

CVE-2019-3824 is a vulnerability in Samba AD DC where an authenticated user with read access to the LDAP server can crash the shared LDAP server process by sending a crafted LDAP search expression, causing a denial of service. The flaw affects Samba versions prior to 4.10, as described in the pro...

CVE-2020-2601

CVE-2020-2601 affects Oracle Java SE and Java SE Embedded Security components. Affected Java SE: 7u241, 8u231, 11.0.5, 13.0.1; Java SE Embedded: 8u231. Root cause is a Kerberos-related issue that can be exploited by an unauthenticated attacker with network access, potentially allowing access to s...

CVE-2021-29447

CVE-2021-29447 is an XXE vulnerability in WordPress media handling (getID3 parsing WAV iXML chunks) that affects WordPress 5.6–5.7 on PHP 8+. Authenticated authors can upload a malicious WAV to trigger XML External Entity substitution (LIBXML_NOENT), enabling access to internal files. The issue i...

CVE-2021-34552

Pillow (Python Imaging Library) vulnerability CVE-2021-34552: Buffer overflow in Convert.c when passing controlled parameters to convert(), affecting Pillow <= 8.2.0 and PIL

CVE-2021-43389

CVE-2021-43389 affects the Linux kernel (pre-5.14.15) with an array-index-out-of-bounds flaw in the ISDN CAPI detach_capi_ctr function (kcapi.c). Multiple sources describe this as a local privilege‑escalation/DoS risk, where a privileged attacker could cause memory corruption, DoS, or potentially...

CVE-2022-23825

CVE-2022-23825 affects AMD processors where branch-predictor aliases can cause misclassification of branches, potentially exposing information. The connected advisories show Linux kernel mitigations are being released for Amazon Linux 2/ALAS kernels (e.g., ALAS2KERNEL-5.10-2025-086 and ALAS2KERNE...

CVE-2022-30122

CVE-2022-30122 affects Rack’s multipart parsing in Rack <2.0.9.1, <2.1.4.1 and

CVE-2023-23920

CVE-2023-23920 is an untrusted search path vulnerability in Node.js that can allow ICU data loading when run with elevated privileges. The initial entry specifies affected versions as <19.6.1, <18.14.1, <16.19.1, and

CVE-2024-21094

CVE-2024-21094 affects Oracle Java SE Hotspot and Oracle GraalVM variants, with affected versions including Java SE 8u401/11.0.22/17.0.10/21.0.2/22 and GraalVM JDK 17.0.10/21.0.2/22, and GraalVM Enterprise 20.3.13/21.3.9. The vulnerability can be exploited remotely via multiple protocols to allow...

CVE-2017-1000257

CVE-2017-1000257: A heap-based buffer overrun in libcurl’s IMAP FETCH handling (zero-length data) can cause reading past the end of a heap buffer, potentially disclosing information or crashing the application. Upstream fix and downstream advisories implement version bumps to 7.56.1-1 or later; a...

CVE-2018-12023

The CVE-2018-12023 issue affects FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (globally or per-property) and the Oracle JDBC jar is in the classpath with an LDAP service accessible to an attacker, the service could be coerced into executing a ma...

CVE-2019-1010238

CVE-2019-1010238 affects Gnome Pango 1.42 and later. The vulnerability is a heap-based buffer overflow in pango_log2vis_get_embedding_levels (involving nchars assignment and the loop condition), exploitable when applications pass invalid UTF-8 strings to functions like pango_itemize. Impact state...

CVE-2019-19462

CVE-2019-19462 affects Linux kernel: relay_open in kernel/relay.c, vulnerable through kernel version 5.4.1, allows local attackers to cause a denial of service (e.g., relay blockage) by triggering a NULL alloc_percpu result. The connected UNITY_LINUX advisories reproduce this description and refe...

CVE-2020-10933

CVE-2020-10933 affects the Ruby interpreter (2.5.x up to 2.5.7, 2.6.x up to 2.6.5, and 2.7.0). The issue occurs in BasicSocket#read_nonblock where the buffer is resized to the requested size but no data is copied, causing the buffer to expose the previous heap contents and potentially expose sens...

CVE-2020-14579

CVE-2020-14579 affects Oracle Java SE/Embedded (Libraries component) with affected Java SE: 7u261 and 8u251; Java SE Embedded: 8u251. The connected advisories confirm network-remote, unauthenticated access leading to a partial denial of service via multiple protocols, per CVSS 3.1 Base Score 3.7 ...

CVE-2020-8449

CVE-2020-8449 affects Squid prior to 4.10. The issue arises from improper input validation in HTTP request processing , allowing crafted requests to access resources that should be blocked by security filters. The connected advisories confirm a fix was released across multiple distributions (e.g....

CVE-2021-35567

CVE-2021-35567 affects Oracle Java SE and GraalVM Enterprise Edition libraries; root cause is incorrect principal selection when Kerberos Constrained Delegation is used. Affected: Java SE 8u301, 11.0.12, 17 and GraalVM EE 20.3.3/21.2.0 (Libraries component). Impact includes potential unauthorized...

CVE-2022-21824

CVE-2022-21824 is a prototype pollution vulnerability in Node.js linked to console.table properties. It affects Node.js prior to patched releases and can be triggered when user-controlled data is passed as the first parameter with a plain object containing an own property such as proto . Public a...

CVE-2024-21012

The CVE-2024-21012 entry concerns Oracle Java SE and Oracle GraalVM variants (JDK and Enterprise Edition) with a Networking component vulnerability. Affected products/versions include Oracle Java SE: 11.0.22, 17.0.10, 21.0.2, 22; GraalVM for JDK: 17.0.10, 21.0.2, 22; GraalVM Enterprise Edition: 2...

CVE-2010-2941

CVE-2010-2941 affects the Common UNIX Printing System (CUPS) cupsd component, specifically ipp.c in CUPS 1.4.4 and earlier. The vulnerability arises from improper memory allocation for attribute values with invalid string data types, enabling a remote attacker to cause a use-after-free and crash,...

CVE-2019-20503

CVE-2019-20503 is an out-of-bounds read in usrsctp’s sctp_load_addresses_from_init. Connected documents confirm affected components (libusrsctp/usrsctp) and indicate versions prior to 0.9.5.0-1 are vulnerable (Mariner packages). A patched version (0.9.5.0-1 or later) is available, per CBLMariner ...

CVE-2019-8942

CVE-2019-8942 affects WordPress core prior to 4.9.9 and 5.x prior to 5.0.1. Affected component is the _wp_attached_file Post Meta; an attacker with author privileges can replace the Post Meta with an arbitrary string (e.g., ending with .jpg?file.php) and, via a crafted image containing PHP in Exi...

CVE-2020-13398

CVE-2020-13398 affects FreeRDP prior to 2.1.1, with an out-of-bounds write in libfreerdp/crypto/crypto.c (crypto_rsa_common). The available connected advisories/public notices confirm this is a boundary-write issue in the RSA crypto code. Impact details in the provided documents are limited to th...

CVE-2020-14796

CVE-2020-14796 affects the Libraries component in Oracle Java SE/Java SE Embedded across multiple OpenJDK builds (e.g., Java-7u271? Java-8u261? Java-11.0.8? Java-15; Embedded 8u261). The vulnerability can be exploited by an unauthenticated attacker over network protocols, but exploitation require...

CVE-2021-21348

XStream (Java) before version 1.4.16 is vulnerable to a denial of service where a remote attacker can cause a thread to consume maximum CPU time and not return. Public documents consistently describe the issue as affecting XStream’s XML deserialization, with mitigation requiring upgrading to at l...

CVE-2021-33655

CVE-2021-33655 is confirmed in the provided documents as an out-of-bounds memory write triggered by malicious data sent via the framebuffer ioctl FBIOPUT_VSCREENINFO in the Linux kernel framebuffer/console path. The issue allows a local user to crash the system and potentially escalate privileges...

CVE-2021-39152

CVE-2021-39152 concerns the XStream Java XML serialization library. The vulnerability allows a remote attacker to request data from internal resources not publicly available by manipulating the processed input stream, impacting systems using affected XStream versions when running Java runtimes ar...

CVE-2022-37601

Prototype pollution in webpack loader-utils: parseQuery.js via the name variable affects all versions prior to 1.4.1 and 2.0.3. CVSS v3.1 base score 9.8 (CRITICAL) with high impact on confidentiality, integrity, and availability. Remediation: upgrade loader-utils to 1.4.1+ or 2.0.3+ (patched vers...

CVE-2025-68615

net-snmp snmptrapd is affected by CVE-2025-68615 via a buffer overflow triggered by a specially crafted trap packet, crashing the daemon. Affected versions are before 5.9.5 and 5.10.pre2; patch versions are 5.9.5 and 5.10.pre2. Remediation: upgrade to those patched releases (or newer).

CVE-2019-14494

Poppler vulnerability CVE-2019-14494 is a divide-by-zero in SplashOutputDev::tilingPatternFill (Poppler up to 0.78.0). The issue affects Poppler-based rendering and can enable denial of service when processing malicious PDFs. Connected advisories (ALAS, Debian LTS, AlmaLinux, CentOS/RHEL, etc.) i...

CVE-2019-16869

Netty (Java) is affected by CVE-2019-16869: HTTP request smuggling due to whitespace before the colon in headers (e.g., Transfer-Encoding : chunked). This can allow a crafted request to poison caches, bypass WAFs, and enable related attacks as described. The core issue is in Netty versions before...

CVE-2019-17267

Summary (CVE-2019-17267): A polymorphic typing deserialization issue in FasterXML Jackson Databind (versions prior to 2.9.10) related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. IBM/X-Force details show a base score of 7.3 (CVSSv3) with high impact on confidentiality, integrit...

CVE-2020-11620

CVE-2020-11620 : Jackson Databind 2.x before 2.9.10.4 has a deserialization issue arising from how serialization gadgets interact with typing, specifically related to org.apache.commons.jelly.impl.Embedded. This allows potential compromise of confidentiality, integrity, and availability (IBM X-Fo...

CVE-2020-25284

The CVE-2020-25284 issue concerns the Rados Block Device (rbd) driver in the Linux kernel. Affected code path is in the rbd subsystem (drivers/block/rbd.c) where permission checks to access rbd devices were incomplete, enabling a local attacker to map or unmap rbd block devices. Multiple connecte...

CVE-2020-27618

Summary (CVE-2020-27618) The vulnerability affects the GNU C Library (glibc) iconv input handling. When processing invalid multi-byte input sequences in specific IBM encodings, iconv may fail to advance the input state, potentially causing an infinite loop and a denial of service. This behavior i...

CVE-2018-12020

GnuPG is affected by CVE-2018-12020: before version 2.2.8, the program mishandles the original filename during decryption/verification, allowing a remote attacker to spoof status output sent to file descriptor 2 via --status-fd 2. This can cause applications that parse status messages to misinter...

CVE-2018-7489

CVE-2018-7489 affects FasterXML jackson-databind; an incomplete fix for CVE-2017-7525 allowed unauthenticated remote code execution via JSON input to ObjectMapper.readValue, with a blacklist bypass if c3p0 is present in the classpath. Affected versions per the initial record include 2.7.9.3, 2.8....