CVE-2019-15216

CVE-2019-15216 affects the Linux kernel prior to 5.0.14, with a NULL pointer dereference triggered by a malicious USB device in drivers/usb/misc/yurex.c. Exploitation could cause a denial of service; impact is indicated as HIGH for availability. A fix is available in kernel 5.0.14 and later. Reme...

CVE-2019-15606

CVE-2019-15606 affects Node.js 10.x, 12.x and 13.x where trailing whitespace in HTTP header values can bypass header-based authorization. Public disclosures in Debian (DSA-4669-1) and Gentoo/Gentoo GLSA-202003-48 confirm multipleVulns including 15606; Elastic KB notes DoS/HTTP‑smuggling implicati...

CVE-2019-16335

CVE-2019-16335 is a vulnerability in FasterXML jackson-databind (pre-2.9.10) related to polymorphic typing in the HikariDataSource path. Connected sources confirm the affected component is jackson-databind and specifically the serialization gadgets involving com.zaxxer.hikari.HikariDataSource. Im...

CVE-2019-16780

CVE-2019-16780 affects WordPress. Lower-privileged users (e.g., contributors) can inject JavaScript into the block editor via a specific payload, which is executed within the WordPress dashboard and can cause XSS if an admin opens the post in the editor. The attack requires an authenticated user....

CVE-2019-5094

CVE-2019-5094 is a vulnerability in the quota file handling of e2fsprogs (ext4 utilities) that can trigger an out-of-bounds write on the heap, enabling potential arbitrary code execution when a malformed ext4 partition is processed. The description across sources identifies the affected component...

CVE-2021-28038

CVE-2021-28038 is a Linux kernel issue (through 5.11.3 with Xen PV) where the netback driver mishandles grant mapping errors, leaving memory allocation/error conditions untreated. In a Xen PV setup, a misbehaving networking frontend driver can trigger a host OS denial of service (Dom0 crash) from...

CVE-2022-1586

CVE-2022-1586 is a confirmed out-of-bounds read in the PCRE2 library affecting the JIT-compiled regex path. The vulnerability occurs in the compile_xclass_matchingpath() function of pcre2_jit_compile.c, related to Unicode property matching where a character may not be fully read during case-less ...

CVE-2024-56374

CVE-2024-56374 affects Django versions 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. The issue is a lack of upper-bound enforcement when validating IPv6 strings, making the undocumented private functions clean_ipv6_address and is_valid_ipv6_address and the django.forms.GenericIPAddr...

CVE-2017-1000369

CVE-2017-1000369 affects Exim 4.89 and earlier. A memory leak caused by multiple -p arguments malloc()’ed without free() can enable a stack-clash path, potentially allowing privilege escalation. Upstream patched in 4.89.1 (commit 65e061b76867a9ea7aeeb535341b790b90ae6c21); Arch Linux notes upgrade...

CVE-2017-15095

Summary of CVE-2017-15095 and related sightings : The material consistently reports a deserialization flaw in jackson-databind, affecting versions prior to 2.8.10 and 2.9.1. An unauthenticated user could trigger code execution via ObjectMapper.readValue with malicious input. The issue is describe...

CVE-2018-7566

CVE-2018-7566 is confirmed in the Connected documents as a Linux kernel 4.15 vulnerability. It describes a buffer overflow in ALSA/seq handling: an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write to /dev/snd/seq can be triggered by a local user. The affected component is the kernel’s sound/ALSA subsy...

CVE-2019-16163

CVE-2019-16163 affects Oniguruma before 6.9.3, causing stack exhaustion (regcomp.c) due to recursion in regparse.c and possible crash. Concrete details appear in IBM/QRadar and related bulletins; base scores listed as 3.3 (NVD) and 7.5/ HIGH in some vectors depending on source. Remediation: upgra...

CVE-2019-9851

CVE-2019-9851 affects Document Foundation LibreOffice prior to 6.2.6, where documents can specify pre-installed scripts that run on global script events (e.g., document-open). The fixed versions validate global script event handlers equivalently to document script handlers, mitigating the issue. ...

CVE-2020-25670

CVE-2020-25670 is a Linux kernel vulnerability affecting the NFC LLCP protocol implementation. The issue is a refcount leak in llcp_sock_bind() that can cause a use-after-free, with the potential for privilege escalation. The connected documents confirm the vulnerability and its association with ...

CVE-2020-6443

Chromium/Google Chrome before 81.0.4044.92 is affected by CVE-2020-6443 due to an insufficient data validation flaw in the DevTools component, enabling a remote attacker to execute arbitrary code via a crafted HTML page after convincing a user to use DevTools. Affected product: Chromium/Chrome; r...

CVE-2021-23973

CVE-2021-23973 describes a cross-origin loading issue in audio/video contexts where a decoding error could leak information about the resource. Affected software: Firefox versions older than 86, Thunderbird older than 78.8, and Firefox ESR older than 78.8. Public-facing details confirm this vulne...

CVE-2021-26932

CVE-2021-26932 affects Linux kernels 3.2 through 5.10.16 when used with Xen PV backends. The issue arises in grant-mapping error handling during batch hypercalls, where errors can be ignored or misreported, causing improper unmapping and potential downstream impact. Affected components include ar...

CVE-2021-34556

CVE-2021-34556 affects the Linux kernel up to 5.13.7. An unprivileged eBPF (BPF) program can leak sensitive kernel memory via a Speculative Store Bypass side-channel, because the protection mechanism did not account for uninitialized memory on the BPF stack. The root cause is information disclosu...

CVE-2022-22824

CVE-2022-22824 affects Expat (libexpat) with an integer overflow in defineAttribute() within xmlparse.c for versions before 2.4.3. The issue is confirmed by connected documents listing multiple Expat CVEs (e.g., CVE-2021-46143, CVE-2022-22822–22827) and advisories referencing 2.4.3 as the fix ver...

CVE-2022-41804

CVE-2022-41804 describes unauthorized error injection in Intel SGX or Intel TDX on some Intel Xeon CPUs that could enable local privilege escalation. Public sources (Intel advisory INTEL-SA-00837 and Debian/Cloud Foundry advisories) confirm the vulnerability and provide mitigations. Affected prod...

CVE-2023-27539

CVE-2023-27539 concerns a denial-of-service vulnerability in the header parsing component of Rack (Ruby Rack). The issue is described as a vulnerability in Rack's header parsing that can affect applications parsing HTTP headers with Rack, leading to potential DoS. The NVD metrics show a MEDIUM-se...

CVE-2023-5477

CVE-2023-5477 describes an inappropriate implementation in the Chrome/Chromium Installer prior to 118.0.5993.70 that could allow a local attacker to bypass discretionary access control via a crafted command. Connected advisories confirm affected products include Google Chrome/Chromium and note a ...

CVE-2017-17485

CVE-2017-17485 affects FasterXML jackson-databind: a deserialization flaw that enables unauthenticated remote code execution via readValue when the blacklist is bypassed if Spring libraries are on the classpath. The initial description specifies impact for jackson-databind up to 2.8.10 and 2.9.x ...

CVE-2018-10940

CVE-2018-10940 affects the Linux kernel, where cdrom_ioctl_media_changed in drivers/cdrom/cdrom.c allows a local attacker to read kernel memory due to an incorrect bounds check in the CDROM_MEDIA_CHANGED ioctl. The vulnerability exists in versions before the 4.16.6 patch, which was released in th...

CVE-2018-20149

WordPress vulnerability CVE-2018-20149 affects WordPress versions prior to 4.9.9 and 5.x prior to 5.0.1 when using Apache. The issue allows uploading crafted files that bypass MIME-type restrictions, enabling cross-site scripting (XSS) as demonstrated by a .jpg file without JPEG data. Debian/DSA ...

CVE-2018-2799

CVE-2018-2799 is an OpenJDK/Oracle Java SE vulnerability affecting the JAXP component. Affected are Java SE: 7u171, 8u162, 10; Java SE Embedded: 8u161; JRockit: R28.3.17. The issue permits an unauthenticated attacker with network access to trigger a partial denial of service. The vulnerability is...

CVE-2019-13307

CVE-2019-13307 affects ImageMagick. The issue is a heap-based buffer overflow in the EvaluateImages path (MagickCore/selective code path) due to mishandling rows, leading to potential crash or arbitrary code execution. Affected release noted in the initial description: ImageMagick 7.0.8-50 Q16. T...

CVE-2019-5831

CVE-2019-5831 reports an object lifecycle issue in V8 used by Google Chrome/Chromium prior to version 75.0.3770.80, enabling potential remote heap corruption via a crafted HTML page. Public advisories and Debian security notices confirm this as a Chromium/V8 issue with multiple CVEs, and remediat...

CVE-2020-15078

OpenVPN 2.5.1 and earlier versions are affected by CVE-2020-15078, permitting remote attackers to bypass authentication and access control and potentially trigger information leaks on servers configured with deferred authentication. The vulnerability affects the OpenVPN component responsible for ...

CVE-2020-25709

CVE-2020-25709 is an OpenLDAP vulnerability where processing a malicious packet by slapd can trigger an assertion failure, primarily threatening availability. The affected component is OpenLDAP’s slapd with a focus on Certificate List syntax validation. Public advisories confirm a denial-of-servi...

CVE-2017-13082

CVE-2017-13082 is one of the KRACK-class WPA2 flaws. Android/Arch/Debian/CentOS references describe an issue where a retransmitted FT Reassociation Request can reinstall the PTK during processing, enabling a nearby attacker to replay, decrypt, or spoof frames. Impact described across sources incl...

CVE-2019-5833

CVE-2019-5833 describes an incorrect dialog box scoping in Google Chrome for Android prior to 75.0.3770.80, enabling a crafted HTML page to display misleading security UI. The vulnerability affects the Chromium/Chrome UI layer and is categorized as a security UI spoofing issue; multiple advisorie...

CVE-2020-25710

Summary of CVE-2020-25710 (OpenLDAP) : A vulnerability in OpenLDAP prior to 2.4.56 allows an attacker sending a crafted packet to cause a failed assertion in csnNormalize23(), with the highest impact on availability (DoS). The issue is rooted in OpenLDAP’s handling of CSN normalization when proce...

CVE-2020-6404

CVE-2020-6404 is a heap-corruption/BLINK-related vulnerability in Google Chrome prior to 80.0.3987.87. Connected documents confirm that this flaw stems from an inappropriate Blink/WebKit implementation, enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page. The...

CVE-2021-37695

CKEditor 4 vulnerability CVE-2021-37695 involves the Fake Objects addon. The issue allows injection of malformed Fake Objects HTML that can lead to JavaScript execution in affected CKEditor 4 plugins when used at versions prior to 4.16.2. Public references in connected documents confirm the affec...

CVE-2021-41771

CVE-2021-41771 is an out-of-bounds read in the Go standard library, specifically ImportedSymbols in debug/macho when parsing malformed binaries with Open/OpenFat. This can cause a panic or denial of service by reading beyond a buffer. Technical details in connected advisories confirm the issue af...

CVE-2022-4337

CVE-2022-4337 describes an out-of-bounds read in Open vSwitch’s Organization Specific TLV across various Open vSwitch versions. The related documents identify Open vSwitch as the affected product with the root cause being an out-of-bounds read in TLV handling, leading to high-severity impact (con...

CVE-2020-26258

CVE-2020-26258 is a Server-Side Forgery/SSRF via XStream unmarshalling in versions prior to 1.4.15. Public docs corroborate exploitation possible by crafted input streams to access internal resources, with Java 15+ mitigating the issue and a whitelist-based Security Framework recommended over the...

CVE-2024-4768

A bug in the interaction between popup notifications and WebAuthn allows attackers to trick users into granting permissions. This vulnerability impacts Firefox < 126 , Firefox ESR < 115.11 , and Thunderbird

CVE-2018-14404

The CVE-2018-14404 entry affects libxml2 (up to 2.9.8). It describes a NULL pointer dereference in xpath.c:xmlXPathCompOpEval() when parsing an invalid XPath expression in the XPATH_OP_AND/OR case, potentially causing a denial-of-service crash for applications processing untrusted XSL inputs. Pub...

CVE-2018-14462

CVE-2018-14462: TCPDUMP has a buffer over-read in the ICMP parser (print-icmp.c:icmp_print()) in versions prior to 4.9.3. A fix was released with tcpdump 4.9.3; upgrade to 4.9.3 or later to remediate. Evidence in connected docs confirms the ICMP over-read and related tcpdump fixes.

CVE-2018-16839

Curl/libcurl versions 7.33.0–7.61.1 are vulnerable to a SASL authentication buffer overrun that may trigger a denial of service. Root cause: improper handling in the SASL code leads to overrun/overflow. Impact: denial of service; no explicit exploit details provided here. Remediation: upgrade to ...

CVE-2018-8781

CVE-2018-8781 affects the Linux kernel udl_fb_mmap() in udl_fb.c, with an integer overflow from kernel 3.4 up to 4.15. It allows a local user with udldrmfb driver access to obtain full read/write permissions on kernel physical pages, enabling kernel-space code execution. No patch/version remediat...

CVE-2019-13311

CVE-2019-13311 is a memory-leak vulnerability in ImageMagick 7.0.8-50 Q16 and earlier, caused by memory not being released in AcquireMagickMemory during MogrifyImageList/MagickWand wand/mogrify.c error paths. Exploitation can lead to Denial of Service via memory exhaustion when processing crafted...

CVE-2020-6439

CVE-2020-6439 affects Google Chrome/Chromium where an insufficient policy enforcement in navigations permits bypassing the security UI via a crafted HTML page. Affected component is the navigation policy enforcement flow in Chromium/Chrome prior to version 81.0.4044.92. The issue is described as ...

CVE-2022-27775

Curl contains an information‑disclosure flaw (CVE-2022-27775) in versions 7.65.0–7.82.0 where an IPv6 address from the pool could be reused with a different zone id, enabling potential leakage through connection reuse. Affected platforms in connected advisories indicate curl/libcurl fixes have be...

CVE-2022-32205

CVE-2022-32205 affects curl and can cause denial of service when a malicious server serves a large number of Set-Cookie headers. curl

CVE-2022-4338

CVE-2022-4338 is an integer underflow in Open vSwitch (Organization Specific TLV) affecting various Open vSwitch versions. Connected sources confirm the issue and link multiple vendor advisories. Impact is high per CVSS, with network attack vector and high confidentiality/integrity/availability i...

CVE-2023-36053

CVE-2023-36053 affects Django’s EmailValidator and URLValidator due to a ReDoS flaw in the regular expression used for domain name labels. Affects Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3. The impact is a potential denial of service with availability compromise, as attacker...

CVE-2023-6270

CVE-2023-6270 affects the Linux kernel AoE (ATA over Ethernet) driver. The flaw is in aoecmd_cfg_pkts(), which improperly updates the refcount of thestruct net_device, allowing a use-after-free when freeing the device and accessing it via the skbtxq queue. This can lead to a denial of service or ...