CVE-2019-13763

CVE-2019-13763 affects Google Chrome: Insufficient policy enforcement in payments in Chrome prior to 79.0.3945.79 allowed a renderer-compromised remote attacker to leak cross-origin data via a crafted HTML page. Affected software is Chrome (renderer process context) with the vulnerability tied to...

CVE-2019-19925

CVE-2019-19925 concerns SQLite 3.30.1. The connected documents identify the vulnerable function as zipfileUpdate in ext/misc/zipfile.c, where a NULL pathname is mishandled during an update of a ZIP archive. The material does not provide additional technical details such as version ranges beyond S...

CVE-2020-9273

CVSS context: CVE-2020-9273 affects ProFTPD, where interrupting a data transfer can corrupt the memory pool, triggering a use-after-free in alloc_pool and potentially enabling remote code execution. What’s affected: ProFTPD (notably around 1.3.7-era releases per advisory) with a memory allocator ...

CVE-2021-21311

Adminer CVE-2021-21311 is a server-side request forgery (SSRF) flaw affecting Adminer versions before 4.7.9, especially builds bundling all drivers (e.g., adminer.php). The issue arises from error-message handling that can expose sensitive information, enabling an attacker to potentially access i...

CVE-2021-30934

The CVE-2021-30934 entry is valid and has concrete details across connected documents. It concerns WebKit/WebKitGTK family processing malicious web content leading to arbitrary code execution due to a buffer overflow. Affected products include Apple platforms: Safari 15.2, macOS Monterey 12.1, iO...

CVE-2021-3144

CVE-2021-3144 affects SaltStack Salt prior to 3002.5. The vulnerability allows eauth tokens to be used once after expiration, potentially enabling an attacker to execute commands against the salt-master or minions. In exposed advisories, the impact is remote command execution with high severity, ...

CVE-2021-3498

GStreamer CVE-2021-3498 is a heap corruption vulnerability in GStreamer prior to 1.18.4 triggered while parsing certain malformed Matroska files. The issue affects the isomp4/qtdemux.c path (and related parsing logic) and can lead to memory corruption if a file hits the problematic code path; no ...

CVE-2021-3630

DjVuLibre: CVE-2021-3630 is an out-of-bounds write in DJVU::DjVuTXT::decode() (DjVuText.cpp) exploitable via crafted DjVu files. Affected in versions prior to 3.5.28; Debian Bullseye fix is 3.5.28-2, and advisories (e.g., USN, other distro notes) recommend upgrading to 3.5.28+. Exploitation statu...

CVE-2021-41133

CVE-2021-41133 affects Flatpak prior to versions 1.10.4 and 1.12.0. The issue allows Flatpak apps with direct AF_UNIX socket access (e.g., Wayland, Pipewire) to abuse VFS-related syscalls not blocked by the denylists in seccomp, manipulating /.flatpak-info or removing it to trick host portals and...

CVE-2022-32091

CVE-2022-32091 affects MariaDB (notably in MariaDB Server components). The public description in the provided documents states a use-after-poison in __interceptor_memset within sanitizer interceptors, implicated in several MariaDB releases. The connected advisories reference related MariaDB issue...

CVE-2016-1248

Vim CVE-2016-1248 is a modeline input-validation vulnerability in which values for the 'filetype', 'syntax', and 'keymap' options could be exploited to execute arbitrary commands when a user opens a file containing a crafted modeline. Affected Vim versions could be compromised, and Neovim is also...

CVE-2016-4447

CVE-2016-4447 affects libxml2 up to version before 2.9.4. The vulnerability is in the xmlParseElementDecl function (parser.c) where a crafted file via xmlParseName can cause a heap-based buffer underread, leading to denial of service (application crash). Remediation: upgrade to libxml2 2.9.4 or n...

CVE-2017-1000501

AWStats is affected by a path-traversal vulnerability in cgi-bin/awstats.pl?config= (and related migrate/config handling) that can disclose or modify files due to improper handling of absolute/partial paths. The issue is described as affecting AWStats 7.7 and earlier, with an incomplete fix in CV...

CVE-2017-10281

CVE-2017-10281 affects Oracle/OpenJDK components (Java SE, Java SE Embedded, JRockit) with the Serialization subcomponent. The vulnerability is exploitable remotely via network protocols and can be triggered by sandboxed Web Start/Applet use or by supplying data to APIs, potentially causing parti...

CVE-2018-10929

CVE-2018-10929 affects GlusterFS (server side), where an authenticated attacker could exploit improper validation in the RPC path (gfs2_create_req) to create arbitrary files and potentially execute arbitrary code on storage server nodes. Connected advisories reference multiple vendors (Debian, Re...

CVE-2019-10131

CVE-2019-10131 (ImageMagick) is an off-by-one read in formatIPTCfromBuffer in ImageMagick before 7.0.7-28. A local attacker could read beyond the end of a buffer or crash the process. Affected: ImageMagick 7.x up to 7.0.7-28. Root cause: off-by-one error in coders/meta.c. Impact: potential inform...

CVE-2019-15945

CVE-2019-15945 affects OpenSC prior to 0.20.0-rc1, with an out-of-bounds access in libopensc/asn1.c decode_bit_string. Several advisories (Arch Linux, AlmaLinux, Debian LTS, others) map this to a vulnerability class that can enable denial of service via malformed data on a local basis. Affected p...

CVE-2019-5768

CVE-2019-5768 affects Google Chrome prior to 72.0.3626.81. The vulnerability arises from DevTools API not correctly gating on extension capability in DevTools, enabling an attacker who persuades a user to install a malicious Chrome Extension to read local files. The issue is fixed by updating to ...

CVE-2019-5814

CVE-2019-5814 affects Google Chrome/Chromium Blink: an insufficient policy enforcement in Blink allowed a remote attacker to leak cross-origin data via a crafted HTML page (CORS bypass). Impact: cross-origin data disclosure. Affected versions are before 74.0.3729.108. Remediation: upgrade to 74.0...

CVE-2020-6393

CVE-2020-6393 affects Google Chrome/Chromium Blink up to version 80.0.3987.87, where insufficient policy enforcement in Blink allowed a remote attacker to leak cross-origin data via a crafted HTML page. The root cause is a policy enforcement flaw in Blink, leading to cross-origin data exposure. A...

CVE-2020-6527

Google Chrome before 84.0.4147.89 has an Insufficient policy enforcement in CSP that could allow a remote attacker to bypass content security policy via a crafted HTML page. This CVE affects Chrome’s CSP handling and was fixed in the 84.0.4147.89 update (stable channel) and related Chromium secur...

CVE-2020-8166

CVE-2020-8166 is a CSRF forgery vulnerability in Ruby on Rails (affecting Rails < 5.2.5 and Rails

CVE-2021-21330

CVE-2021-21330 affects aiohttp up to version 3.7.4, with an open redirect caused by a bug in aiohttp.web_middlewares.normalize_path_middleware. The vulnerability allows a malicious link to redirect a user’s browser to an attacker-controlled site. The issue is fixed in aiohttp 3.7.4. Remediation: ...

CVE-2021-3472

CVE-2021-3472 affects xorg-x11-server and related packages up to version before 1.20.11. The root cause is an integer underflow in the X server component (notably XChangeFeedbackControl) that can lead to local privilege escalation, with potential impact to confidentiality, integrity, and availabi...

CVE-2022-0943

CVE-2022-0943 affects Vim/vim before 8.2.4563. The vulnerability is described as a heap-based buffer overflow in Vim. The connected documents confirm this CVE is listed among Vim-related issues, but do not provide a detailed root cause or exploit specifics beyond the heap-based overflow. Remediat...

CVE-2023-4752

CVE-2023-4752 is a use-after-free in Vim’s ins_compl_get_exp() affecting Vim/vim before 9.0.1858. Connected advisories confirm the issue and list affected platforms/distributions (Debian, AlmaLinux, Amazon Linux, etc.). Remediation in publicly referenced notes is to upgrade Vim to a version conta...

CVE-2015-3166

CVE-2015-3166 affects PostgreSQL; the snprintf implementation fails to properly handle errors from system calls, which can lead to information disclosure or other unspecified impact via out-of-memory scenarios. Affected versions include PostgreSQL releases before 9.0.20, 9.1.x before 9.1.16, 9.2....

CVE-2015-5174

Summary: CVE-2015-5174 is a directory traversal vulnerability in Apache Tomcat’s RequestUtil.java that affects Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27. A remote authenticated user could bypass SecurityManager restrictions and list a parent directory by using a /.. seque...

CVE-2016-7056

CVE-2016-7056 describes a timing attack in OpenSSL 1.0.1u and earlier that could allow a local attacker to recover an ECDSA P-256 private key. The root cause is a timing side-channel during ECDSA signing; no remote/external access requirement is stated in the sources, only local access. Publicly ...

CVE-2017-9076

CVE-2017-9076 is a Linux kernel issue reported in the CentOS/Red Hat advisory set (CESA-2018:1854) tied to the IPv6 DCCP implementation. The vulnerability arises from mishandling of inheritance in the IPv6 DCCP code, allowing a local attacker to cause a denial of service or possibly other unspeci...

CVE-2018-10855

CVE-2018-10855 affects Ansible: versions 2.5 prior to 2.5.5 and 2.4 prior to 2.4.5 do not honor the no_log flag for failed tasks, which can cause sensitive data passed to a task to be exposed in logs and on the user’s terminal when the task fails. Red Hat advisories (RHSA-2018:1948, RHSA-2019:005...

CVE-2018-2800

CVE-2018-2800 affects Oracle Java SE/JRockit (RMI) and is reflected in multiple public advisories. Affected Java SE: 6u181, 7u171, 8u162; JRockit: R28.3.17. The vulnerability involves the Java SE JRockit RMI component and can allow an unauthenticated network-access attacker to compromise data via...

CVE-2019-5773

CVE-2019-5773 : Insufficient origin validation in IndexedDB in Google Chrome before 72.0.3626.81 allows a remote attacker who compromised the renderer process to bypass the same-origin policy via a crafted HTML page. Affected product/version: Google Chrome (IndexedDB). Root cause: origin validati...

CVE-2019-7397

CVE-2019-7397 affects ImageMagick before 7.0.8-25 and GraphicsMagick up to 1.3.31. The issue is memory leaks in WritePDFImage (coders/pdf.c). Impact is memory consumption/leakage, potentially contributing to denial of service under heavy or repeated image processing scenarios, as described in ass...

CVE-2020-16119

CVE-2020-16119 is a Linux kernel use-after-free vulnerability in DCCP where a socket reused as a listener after release (with an attached dccps_hc_tx_ccid) can be exploited locally. Affected: Linux kernel variants affected by upstream fixes; the issue allows local escalation to execute code or ca...

CVE-2020-27751

ImageMagick vulnerability CVE-2020-27751 affects MagickCore/quantum-export.c. Processing a crafted file can trigger undefined behavior: values outside the range of unsigned long long and a shift exponent too large for 64-bit, with the likely impact on availability. Affected are ImageMagick versio...

CVE-2020-3810

CVE-2020-3810 : Missing input validation in the ar/tar implementations of apt could cause a denial of service when processing specially crafted deb files. Affected: apt before 2.1.2. Remediation: upgrade to apt 2.1.2 or newer (per Debian/ Fedora advisories referencing the fix).

CVE-2020-6462

CVE-2020-6462 is a use-after-free in Chrome/Chromium task scheduling that could allow a renderer-compromised remote attacker to escape the sandbox via a crafted HTML page. Affected: Google Chrome/Chromium prior to 81.0.4044.129. Impact and remediation as stated in connected sources: patches exist...

CVE-2020-6486

CVE-2020-6486 is an access restriction bypass in the navigations component of the Chromium/Google Chrome browser, prior to version 83.0.4103.61. The vulnerability stems from insufficient policy enforcement in navigations, enabling a remote attacker to bypass navigation restrictions via a crafted ...

CVE-2020-6512

CVE-2020-6512: A type confusion in Google Chrome’s V8 engine prior to 84.0.4147.89 could allow a remote attacker to exploit heap corruption via a crafted HTML page, potentially enabling arbitrary code execution. Affected product: Chrome (V8). Root cause: type confusion in V8. Impact: remote code ...

CVE-2021-25633

CVE-2021-25633 affects The Document Foundation LibreOffice. It is an Improper Certificate Validation vulnerability where an attacker can create a digitally signed ODF document by manipulating documentsignatures.xml or macrosignatures.xml; LibreOffice may display a valid signature while the conten...

CVE-2021-40330

CVE-2021-40330 affects the Git project: in git_connect_git (connect.c) of Git before 2.30.1, a repository path can contain a newline character, which may trigger unexpected cross-protocol requests as demonstrated by a crafted git://localhost:1234/%0d%0a%0d%0aGET%20/%20HTTP/1.1 sequence. The vulne...

CVE-2023-0045

The CVE-2023-0045 entry concerns the Linux kernel Spectre v2 mitigation for prctl-based task toggling. The underlying issue is that IBPB is not issued immediately during the prctl syscall; ib_prctl_set updates TIFs and SPEC_CTRL MSR, but IBPB is only emitted on the next schedule after TIF checks....

CVE-2023-5721

CVE-2023-5721 describes a UX vulnerability where certain browser prompts and dialogs could be activated or dismissed unintentionally by users due to an insufficient activation-delay. Affected products/versions per provided documents: Firefox prior to 119, Firefox ESR prior to 115.4, and Thunderbi...

CVE-2015-9383

CVE-2015-9383 affects FreeType prior to 2.6.2, with a heap-based buffer over-read in tt_cmap14_validate (sfnt/ttcmap.c). Connected documents corroborate the presence of this CVE and list FreeType versions affected across multiple advisories, but do not provide a vendor/product fix details beyond ...

CVE-2017-10345

CVE-2017-10345 affects Oracle Java SE/Embedded/JRockit serialization. The vulnerability allows an unauthenticated attacker with network access to compromise the target, potentially causing a partial denial of service; exploitation is difficult and may require human interaction. Affected versions ...

CVE-2018-10928

GlusterFS vulnerability CVE-2018-10928: an authenticated remote attacker could exploit improper validation of RPC requests via gfs3_symlink_req to create arbitrary symlinks outside the volume and potentially execute code on the server. Public advisories document multiple remediation streams acros...

CVE-2018-2677

CVE-2018-2677 affects Oracle Java SE and Java SE Embedded (AWT). A vulnerability in the Java SE/JRE AWT component could allow an unauthenticated attacker with network access to cause a partial denial of service on affected Java deployments (client sandboxed usage). Affected versions per descripti...

CVE-2019-13137

CVE-2019-13137 affects ImageMagick prior to 7.0.8-50, with a memory-leak vulnerability in ReadPSImage (coders/ps.c). Exploitation could cause resource exhaustion and instability as described in multiple security feeds. The issue is specific to ImageMagick’s PS reader; it is not a general vulnerab...

CVE-2019-7577

CVE-2019-7577 affects SDL: a buffer over-read in audio/SDL_wave.c (SDL_LoadWAV_RW) linked to SDL 1.2.15 and 2.x up to 2.0.9. Connected advisories confirm multiple SDL-related CVEs with similar memory issues (buffer over-reads/overflows) across libsdl1.2/libsdl2 and SDL components, risking arbitra...