CVE-2021-42771

CVE-2021-42771 affects Babel.Locale in the Babel project; versions prior to 2.9.1 are vulnerable. The issue arises from directory traversal that allows loading arbitrary locale .dat files containing serialized Python objects, enabling code execution. Public advisories (e.g., Debian LTS, AlmaLinux...

CVE-2022-32205

CVE-2022-32205 affects curl and can cause denial of service when a malicious server serves a large number of Set-Cookie headers. curl

CVE-2023-23559

CVE-2023-23559 affects the Linux kernel rndis_wlan.c (rndis_query_oid) up to version 6.1.5. The vulnerability arises from an integer overflow in an addition, which may lead to a buffer overflow. Connected sources corroborate the issue and reference updates/mitigations in related advisories (e.g.,...

CVE-2024-5690

Vulnerability CVE-2024-5690 affects Mozilla Firefox and Thunderbird components via a timing-attack on external protocol handler detection. Affected products explicitly include Firefox < 127, Firefox ESR < 115.12, and Thunderbird

CVE-2018-16839

Curl/libcurl versions 7.33.0–7.61.1 are vulnerable to a SASL authentication buffer overrun that may trigger a denial of service. Root cause: improper handling in the SASL code leads to overrun/overflow. Impact: denial of service; no explicit exploit details provided here. Remediation: upgrade to ...

CVE-2018-20149

WordPress vulnerability CVE-2018-20149 affects WordPress versions prior to 4.9.9 and 5.x prior to 5.0.1 when using Apache. The issue allows uploading crafted files that bypass MIME-type restrictions, enabling cross-site scripting (XSS) as demonstrated by a .jpg file without JPEG data. Debian/DSA ...

CVE-2019-15118

CVE-2019-15118 affects the Linux kernel up to version 5.2.9. The vulnerability arises from the function check_input_term in sound/usb/mixer.c , which mishandles recursion and can cause a kernel stack exhaustion leading to a crash. The connected Nessus entries corroborate the issue and reference U...

CVE-2020-6430

CVE-2020-6430 is a type confusion in the V8 JavaScript engine of Chromium/Google Chrome prior to 81.0.4044.92. A remote attacker could potentially cause heap corruption and execute arbitrary code. Mitigation: upgrade Chromium to 81.0.4044.92 or newer (upstream fix in 81.0.4044.92; Debian referenc...

CVE-2021-20257

CVE-2021-20257 concerns QEMU’s e1000 NIC emulator. The issue is an infinite loop in process_tx_desc when tx descriptor fields are invalid, allowing a guest to exhaust host CPU and cause DoS. Connected advisories confirm this affects QEMU and related builds (e.g., Debian LTS, Red Hat/AL2, Astra Li...

CVE-2021-28688

CVE-2021-28688 relates to the Linux kernel fix for XSA-365. The patch initialized pointers to avoid cleanup issues, but under certain conditions it could overwrite pointers that need cleanup, causing persistence leaks and, consequently, incomplete host cleanup after a guest dies, leaving zombie d...

CVE-2022-4338

CVE-2022-4338 is an integer underflow in Open vSwitch (Organization Specific TLV) affecting various Open vSwitch versions. Connected sources confirm the issue and link multiple vendor advisories. Impact is high per CVSS, with network attack vector and high confidentiality/integrity/availability i...

CVE-2023-6270

CVE-2023-6270 affects the Linux kernel AoE (ATA over Ethernet) driver. The flaw is in aoecmd_cfg_pkts(), which improperly updates the refcount of thestruct net_device, allowing a use-after-free when freeing the device and accessing it via the skbtxq queue. This can lead to a denial of service or ...

CVE-2018-1000120

CVE-2018-1000120 affects curl/libcurl’s FTP URL parsing (CURLOPT_FTP_FILEMETHOD). A crafted FTP URL can trigger a NIL-byte out-of-bounds write, causing a crash or potentially more serious effects. CVE-2018-1000121 is a NULL-pointer dereference in the LDAP handling path, exploitable via LDAP URLs ...

CVE-2018-14462

CVE-2018-14462: TCPDUMP has a buffer over-read in the ICMP parser (print-icmp.c:icmp_print()) in versions prior to 4.9.3. A fix was released with tcpdump 4.9.3; upgrade to 4.9.3 or later to remediate. Evidence in connected docs confirms the ICMP over-read and related tcpdump fixes.

CVE-2018-15518

CVE-2018-15518 and related Qt vulnerabilities affect Qt5.x up to 5.11.3 (and older Qt4.x in Debian/ALT Linux/CentOS advisories). Concrete issues include: CVE-2018-15518 Double-free or corruption in QXmlStreamReader during parsing of specially crafted illegal XML; CVE-2018-19869 malformed SVG trig...

CVE-2019-12527

CVE-2019-12527 affects Squid 4.0.23–4.7. The issue arises in Basic Authentication handling: HttpHeader::getAuth decodes the Base64 blob into a fixed-size buffer without confirming decoded length, causing a heap-based buffer overflow with user-controlled data. Some sources note this can lead to re...

CVE-2019-19880

CVE-2019-19880 affects SQLite 3.30.1. The issue arises in exprListAppendList in window.c, where constant integer values in ORDER BY clauses of window definitions are mishandled, allowing an attacker to trigger an invalid pointer dereference. This is described in multiple connected sources (Astra ...

CVE-2019-20367

CVE-2019-20367 is a vulnerability in libbsd where the symbol-table handling in nlist.c can read beyond bounds when comparing a symbol name from the string table. Affected: libbsd before 0.10.0 (older releases). Root cause: out-of-bounds read (CWE-125) in nlist.c. Impact: potential crash or crash-...

CVE-2020-13632

SQLite vuln CVE-2020-13632 affects ext/fts3/fts3_snippet.c in SQLite

CVE-2021-28662

CVE-2021-28662 affects Squid 4.x before 4.15 and 5.x before 5.0.6. A remote server sending a certain HTTP/HTTPS response header can trigger a denial-of-service in the proxy via input/response handling. This is the same class of DoS as described in multiple advisories (e.g., Arch Linux, Debian, Al...

CVE-2022-0413

CVE-2022-0413 is described in connected advisories as a vulnerability in vim where memory previously freed could be re-used, enabling a crafted file to crash vim or potentially execute code. The affected product is vim (GitHub vim/vim source base) and prior to version 8.2. The issue is framed as ...

CVE-2022-3545

CVE-2022-3545: Linux Kernel use-after-free in area_cache_get (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c, IPsec). Affects local attacker within LAN via area_cache_get manipulation; initial description notes a patch exists to fix the issue. Connected Astra Linux bulletin provides con...

CVE-2024-4768

CVE-2024-4768 involves a bug in the interaction between popup notifications and WebAuthn that could enable a user-permission bypass in the affected Mozilla products. The concrete impact described in connected advisories applies to Firefox and Firefox ESR (and Thunderbird): an attacker could trick...

CVE-2024-56374

CVE-2024-56374 affects Django versions 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. The issue is a lack of upper-bound enforcement when validating IPv6 strings, making the undocumented private functions clean_ipv6_address and is_valid_ipv6_address and the django.forms.GenericIPAddr...

CVE-2016-2147

CVE-2016-2147 affects BusyBox’s DHCP client (udhcpc) prior to 1.25.0. An integer overflow in handling a malformed RFC1035-encoded domain name can trigger an out-of-bounds heap write, allowing remote attackers to cause a denial of service (crash) via the network. The initial description specifies ...

CVE-2017-10661

CVE-2017-10661 is a race condition in Linux kernel timerfd (fs/timerfd.c) that affects versions before 4.10.15. The flaw arises from improper protection of the might_cancel queue during concurrent timerfd operations, enabling local attackers to cause a denial of service or gain privileges via lis...

CVE-2017-14495

CVE-2017-14495 affects dnsmasq: memory exhaustion/DoS in the EDNS0 code when using add-mac, add-cpe-id, or add-subnet. Root cause is a memory leak leading to unbounded memory consumption and possible crash. Upstream fixes exist in dnsmasq 2.78; multiple advisories/applications (ALAS2-2019-1251, C...

CVE-2019-11730

CVE-2019-11730 describes a same-origin policy violation where opening a locally saved HTML file could allow file: URIs to access files in the same directory or subdirectories, enabling the Fetch API to read contents and potentially exfiltrate them. The issue affects Firefox ESR < 60.8, Firefox...

CVE-2020-2816

CVE-2020-2816 affects Oracle Java SE JSSE in Java SE 11.0.6 and 14. The vulnerability allows an unauthenticated attacker with network access via HTTPS to compromise Java SE, potentially enabling unauthorized creation, deletion, or modification of data in Java SE‑accessible data. The description n...

CVE-2020-36310

CVE-2020-36310 affects the Linux kernel prior to 5.8, specifically arch/x86/kvm/svm/svm.c, where set_memory_region_test can infinite-loop on certain nested page faults (CID-e72436bc3a52). The connected Nessus/OSS documents confirm this exact issue in Unity Linux kernels and Debian/openSUSE adviso...

CVE-2021-26931

CVE-2021-26931 is a Linux kernel issue in Xen PV backend handling. Affected: kernel 2.6.39–5.10.16 when running Xen PV; vulnerable components include block/xen-blkback/blkback.c and xen-scsiback.c. Root cause: grant-mapping error handling could be treated as a plain bug, leading to a kernel crash...

CVE-2021-35039

The CVE-2021-35039 issue affects the Linux kernel up to version 5.12.14 where module signature verification can be bypassed if CONFIG_MODULE_SIG is not set and a module.sig_enforce=1 argument is used during init_module loading. Affected component: kernel/module.c. Root cause: mishandling of signa...

CVE-2021-3527

CVE-2021-3527 affects the QEMU USB redirector (usb-redir). A flaw lets the guest influence the length of a dynamically allocated VLA on the stack by combining small USB packets into a large bulk transfer, with no bounded total size, causing a denial of service on the QEMU process. Public advisori...

CVE-2021-38198

CVE-2021-38198 affects the Linux kernel’s KVM implementation for x86. The vulnerability resides in arch/x86/kvm/mmu/paging_tmpl.h where shadow page access permissions are computed incorrectly, leading to a missing guest protection page fault. This can undermine guest isolation and may enable inst...

CVE-2023-36053

CVE-2023-36053 affects Django’s EmailValidator and URLValidator due to a ReDoS flaw in the regular expression used for domain name labels. Affects Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3. The impact is a potential denial of service with availability compromise, as attacker...

CVE-2013-4365

The vulnerability CVE-2013-4365 affects Apache HTTP Server’s mod_fcgid module. A heap-based buffer overflow in fcgid_header_bucket_read (fcgid_bucket.c) prior to version 2.3.9 could allow remote attackers to cause an impact via unspecified vectors. Affected product/version: mod_fcgid before 2.3.9...

CVE-2017-2619

CVE-2017-2619 affects Samba before versions 4.6.1, 4.5.7 and 4.4.11. The issue is a race condition in the Samba server’s handling of symbolic links (symlinks) that a malicious client can trigger to access files and directories outside the share-export boundaries. This permits access to areas of t...

CVE-2021-20321

CVE-2021-20321 is a race-condition vulnerability in the Linux kernel OverlayFS subsystem affecting how file renames are performed, potentially allowing a local attacker to crash the system via OverlayFS misuse. Connected advisories corroborate that the issue resides in OverlayFS file object handl...

CVE-2021-29264

The CVE-2021-29264 issue affects the Linux kernel’s Freescale Gianfar Ethernet driver (drivers/net/ethernet/freescale/gianfar.c). A negative fragment size is computed in scenarios with an RX queue overrun when jumbo packets are used and NAPI is enabled, enabling a network attacker to crash the sy...

CVE-2023-5479

CVE-2023-5479 corresponds to an insufficiently secure Extensions API in Google Chrome/Chromium before 118.0.5993.70, enabling a user-assisted bypass of enterprise policy via a crafted HTML page if a malicious extension is installed. Public details across connected documents confirm the affected c...

CVE-2017-2862

CVE-2017-2862 affects Gdk-Pixbuf 2.36.6, with a heap overflow in gdk_pixbuf__jpeg_image_load_increment that can be triggered by a crafted JPEG file (or URL) to achieve remote code execution. Multiple connected documents confirm the vulnerability and provide remediation guidance, including Debian ...

CVE-2018-21010

OpenJPEG is affected by CVE-2018-21010: a heap buffer overflow in color_apply_icc_profile (bin/common/color.c) present in OpenJPEG releases before 2.3.1. The CVE is tied to OpenJPEG under multiple advisories and Nessus/OpenVAS feeds reference this issue among OpenJPEG 2.3.x and earlier branches. ...

CVE-2019-10192

CVE-2019-10192 is a heap-buffer overflow in Redis HyperLogLog used by SETRANGE. Affected: Redis HyperLogLog in 3.x before 3.2.13, 4.x before 4.0.14, and 5.x before 5.0.4. By corrupting a hyperloglog, an attacker can cause Redis to write up to 3 bytes beyond the end of a heap-allocated buffer. Imp...

CVE-2019-11287

CVE-2019-11287 affects Pivotal RabbitMQ and RabbitMQ for Pivotal Platform web management plugin. Versions 3.7.x before 3.7.21, 3.8.x before 3.8.1, and 1.16.x before 1.16.7 and 1.17.x before 1.17.4 are vulnerable. The vulnerability allows a crafted X-Reason HTTP header to inject a malicious Erlang...

CVE-2019-15133

CVE-2019-15133 is a vulnerability in GIFLIB where a malformed GIF can trigger a divide-by-zero in the DGifSlurp decoder when the ImageSize height is zero. Connected advisories confirm the issue affects GIFLIB up to versions prior to 5.2.1, with remediation provided by updating to 5.2.1 (e.g., SUS...

CVE-2019-19524

CVE-2019-19524 affects the Linux kernel (before 5.3.12) with a use-after-free in drivers/input/ff-memless.c caused by a malicious USB device, leading to kernel panics. upstream patch available (e.g., ChangeLog-5.3.12) and vendor advisories reference mitigations and fixes. The connected documents ...

CVE-2019-5824

CVE-2019-5824 affects the Chromium/Chrome media path: a parameter-passing error in the media component could enable heap corruption via a crafted HTML page. Connected advisories corroborate that Chromium/Chrome updates across distributions (e.g., Debian DSA-4500-1, openSUSE/Fedora advisories) add...

CVE-2020-13754

CVE-2020-13754 affects QEMU 4.2.0, where hw/pci/msix.c allows an out-of-bounds access via a crafted address in an msi-x MMIO operation. The connected documents confirm the exact vulnerable component and condition but do not provide a specific, universally applicable patched version within the CVE...

CVE-2020-6831

CVE-2020-6831 is a bug described in Debian security advisories as a buffer overflow in the SCTP chunk input validation in the usrsctp library. The Debian entries explicitly tie this CVE to Firefox ESR (<68.8), Firefox (<76) and Thunderbird (

CVE-2021-32672

Redis contains CVE-2021-32672, a vulnerability in the Redis Lua Debugger where the protocol parser can read data beyond the actual buffer when handling malformed requests. This affects Redis builds that include Lua debugging support (3.2+). The issue is mitigated by upgrading to patched releases:...