CVE-2020-28032

CVE-2020-28032 affects WordPress prior to 5.5.2, caused by unsafe deserialization in wp-includes/Requests/Utility/FilteredIterator.php (Requests_Utility_FilteredIterator). The provided data notes high-severity impact (CVE‑SS scores show critical/high across CONF, INTE, AVAIL) with network attack ...

CVE-2020-6534

CVE-2020-6534: Heap buffer overflow in WebRTC of Google Chrome (Chromium) prior to 84.0.4147.89. A crafted HTML page could trigger heap corruption, potentially enabling arbitrary code execution. The connected FreeBSD/Vuxml entry confirms CVE-2020-6534 as part of Chrome/Chromium security fixes and...

CVE-2021-3482

Exiv2 vulnerability CVE-2021-3482 affects versions up to 0.27.4-RC1, due to improper input validation of rawData.size in Jp2Image::readMetadata() that can cause a heap-based buffer overflow when processing a crafted JPEG with malicious EXIF data. Exploitation could lead to arbitrary code executio...

CVE-2022-36280

CVE-2022-36280: An out-of-bounds memory access in the vmwgfx GPU driver (vmwgfx_kms.c) of the Linux kernel’s vmwgfx component, affecting devices using /dev/dri/renderD128. Reported as a local privilege escalation leading to DoS. Public details in connected docs confirm the vulnerability and its p...

CVE-2022-4515

Exuberant Ctags is affected by CVE-2022-4515 due to unsafe handling of the -o option. A crafted tag filename can cause arbitrary command execution because externalSortTags() calls system(3) in an unsafe way (root cause in sort.c). Connected advisories indicate the issue affects ctags broadly and ...

CVE-2018-10927

CVE-2018-10927 affects GlusterFS where an authenticated attacker could abuse RPC gfs3_lookup_req to leak information and cause remote denial of service by crashing the gluster brick process. Exploitation details in connected IBM PowerKVM advisory tied to PowerKVM 3.1; fixed in PowerKVM 3.1.0.2 up...

CVE-2018-2794

CVE-2018-2794 is an OpenJDK/Java SE issue affecting multiple deserialization-related paths (including JCEKS, security/JAXP, and RMI) with a vulnerability in a range of Java versions (e.g., 6u/7u/8u and 10). Connected advisories confirm affected products and provide fixes: Debian openjdk-7 update ...

CVE-2018-2800

CVE-2018-2800 affects Oracle Java SE/JRockit (RMI) and is reflected in multiple public advisories. Affected Java SE: 6u181, 7u171, 8u162; JRockit: R28.3.17. The vulnerability involves the Java SE JRockit RMI component and can allow an unauthenticated network-access attacker to compromise data via...

CVE-2018-5750

Technical details beyond the initial description are not present in the connected documents. The CVE-2018-5750 issue in the Linux kernel (via acpi_smbus_hc_add and SBS HC printk) is described in the Initial document as a local information disclosure; no additional public exploit/vendor-specific d...

CVE-2019-10131

CVE-2019-10131 (ImageMagick) is an off-by-one read in formatIPTCfromBuffer in ImageMagick before 7.0.7-28. A local attacker could read beyond the end of a buffer or crash the process. Affected: ImageMagick 7.x up to 7.0.7-28. Root cause: off-by-one error in coders/meta.c. Impact: potential inform...

CVE-2019-16789

Affected software: Waitress (Python WSGI server) up to version 1.4.0. Vulnerability arises when a front-end proxy sends requests with Transfer-Encoding containing invalid whitespace characters; Waitress may parse such requests as chunked while the front-end uses Content-Length, enabling HTTP requ...

CVE-2019-18683

CVE-2019-18683 affects the Linux kernel’s V4L2 vivid driver (drivers/media/platform/vivid). The issue arises from wrong mutex locking in functions vivid_stop_generating_vid_cap(), vivid_stop_generating_vid_out(), sdr_cap_stop_streaming(), and related kthreads, causing multiple race conditions dur...

CVE-2019-20839

CVE-2019-20839 affects LibVNCServer: a buffer overflow in libvncclient/sockets.c can be triggered by a long socket filename, impacting versions prior to 0.9.13. The issue may enable remote code execution or crashes as implied by the buffer overflow vulnerability, with reports across distributions...

CVE-2019-7397

CVE-2019-7397 affects ImageMagick before 7.0.8-25 and GraphicsMagick up to 1.3.31. The issue is memory leaks in WritePDFImage (coders/pdf.c). Impact is memory consumption/leakage, potentially contributing to denial of service under heavy or repeated image processing scenarios, as described in ass...

CVE-2020-6536

CVE-2020-6536 affects Google Chrome/Chromium PWAs. Root cause: Incorrect security UI in PWAs allowed a crafted PWA to spoof the Omnibox (URL bar). Impact: potential for spoofing the address bar content via a remote PWA installation. Remediation: update to Chrome/Chromium 84.0.4147.89 (stable chan...

CVE-2021-33623

CVE-2021-33623 : The trim-newlines package for Node.js is vulnerable to a regular-expression Denial of Service (ReDoS) on the .end() method. Affected versions are before 3.0.1 and 4.x before 4.0.1. Remedies include upgrading to trim-newlines 3.0.1 or 4.0.1 (or later). The available connected docu...

CVE-2021-40330

CVE-2021-40330 affects the Git project: in git_connect_git (connect.c) of Git before 2.30.1, a repository path can contain a newline character, which may trigger unexpected cross-protocol requests as demonstrated by a crafted git://localhost:1234/%0d%0a%0d%0aGET%20/%20HTTP/1.1 sequence. The vulne...

CVE-2022-0359

CVE-2022-0359 is described in connected docs as a Heap-based Buffer Overflow in vim/vim prior to 8.2. The Astra Linux bulletin reiterates the issue, and Cloud Foundry’s USN listing includes this CVE among Vim-related flaws. The provided materials do not specify the exact affected product version ...

CVE-2022-31163

CVE-2022-31163 affects the TZInfo Ruby library. The vulnerability arises when TZInfo::Timezone.get validates time zone identifiers, allowing a newline in the identifier to cause relative path traversal and, with Ruby 1.9.3+, loading unintended files via require. Affected versions are TZInfo prior...

CVE-2023-2603

CVE-2023-2603 concerns libcap: an integer overflow in the internal function _libcap_strdup() when handling very large input strings (near 4 GiB). The issue is exploitable locally and is rated high severity (C/H/I/A). Multiple advisories confirm libcap2 updates to fix this, including Debian’s DLA-...

CVE-2023-4357

CVE-2023-4357 affects Google Chrome (Chromium-based) and its Chromium derivatives. The vulnerability is caused by insufficient validation of untrusted input in XML, enabling a remote attacker to bypass file access restrictions via a crafted HTML page. Public records confirm impact on Chrome befor...

CVE-2017-10281

CVE-2017-10281 affects Oracle/OpenJDK components (Java SE, Java SE Embedded, JRockit) with the Serialization subcomponent. The vulnerability is exploitable remotely via network protocols and can be triggered by sandboxed Web Start/Applet use or by supplying data to APIs, potentially causing parti...

CVE-2018-18313

Perl before 5.26.3 is affected by a buffer over-read triggered by crafted regular expressions, which can disclose sensitive data from process memory. Public sources (e.g., USN-3834-1, Debian/CVE trackers) confirm CVE-2018-18313 and list affected platforms, noting that upgrading to Perl 5.26.3 or ...

CVE-2018-2640

The CVE refers to CVE-2018-2640 in the MySQL/MariaDB family: the vulnerability is in the MySQL Server component (Server: Optimizer) and affects multiple supported branches (5.5.x, 5.6.x, 5.7.x) with ability for a network‑accessible, low‑privileged attacker to cause a hang or crash (DOS). Public a...

CVE-2018-8778

CVE-2018-8778 affects Ruby prior to 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1. It describes a buffer under-read in String#unpack triggered by an attacker-controlled unpacking format, leading to massive information disclosure. Affected platforms include...

CVE-2019-13749

CVE-2019-13749 is a UI spoof vulnerability in the Omnibox (URL bar) of Google Chrome/Chromium. The issue allowed spoofing via a crafted page. Mitigation observed in connected advisories: update to a patched Chrome/Chromium version (e.g., Debian/Ubuntu debs list fixes to 79.0.3945.130+; Fedora upd...

CVE-2019-13754

CVE-2019-13754 affects Google Chrome/Chromium where insufficient policy enforcement in extensions could let a remote attacker bypass navigation restrictions via a crafted HTML page. The vulnerability is scoped to Chrome versions before 79.0.3945.79. Public advisories and updates indicate remediat...

CVE-2019-17542

CVE-2019-17542 is a heap-based buffer overflow in FFmpeg’s vqa_decode_chunk (out-of-array access in vqa_decode_init, libavcodec/vqavideo.c). Multiple advisories confirm the issue and fixes; affected FFmpeg releases prior to the patched version are vulnerable. Mitigation: upgrade FFmpeg to a relea...

CVE-2019-19553

Wireshark CMS dissector crash (CVE-2019-19553). Affected: Wireshark 3.0.0–3.0.6 and 2.6.0–2.6.12. Root cause: CMS ContentInfo dissection could leave a non-NULL object identifier, leading to a crash. Remedy: set the object identifier to NULL after ContentInfo dissection in epan/dissectors/asn1/cms...

CVE-2019-5766

CVE-2019-5766 describes an incorrect origin taint handling in Canvas within Chromium/Google Chrome, which could allow a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability is tied to the Canvas origin taint check and is listed against Chrome versions prior to 72.0...

CVE-2019-5768

CVE-2019-5768 affects Google Chrome prior to 72.0.3626.81. The vulnerability arises from DevTools API not correctly gating on extension capability in DevTools, enabling an attacker who persuades a user to install a malicious Chrome Extension to read local files. The issue is fixed by updating to ...

CVE-2019-6128

CVE-2019-6128 : LibTIFF 4.0.10 is affected by a memory leak in the TIFFFdOpen function (tif_unix.c), demonstrated by pal2rgb. The initial description does not provide details on exploit vectors, impact scope beyond memory leakage, or available remediations. Based on the provided document, there i...

CVE-2020-11076

CVE-2020-11076 affects Puma (RubyGem). The issue allows an attacker to smuggle an HTTP response by using an invalid transfer-encoding header. Affected versions are Puma before 4.3.4 and 3.12.5; fixes are in Puma 4.3.4 and 3.12.5. Connected advisories and bulletins (Debian, openSUSE/openSUSE-2020-...

CVE-2020-11765

CVE-2020-11765 concerns OpenEXR prior to 2.4.1, where an off-by-one error in the ImfXdr.h read function used by DwaCompressor::Classifier::Classifier caused an out-of-bounds read. Public disclosures and vendor advisories (OpenEXR/OpenEXR 2.4.1 release notes; GLSA-202107-27; Debian DLA-2358-1) con...

CVE-2021-3570

The CVE-2021-3570 entry concerns linuxptp’s ptp4l, where a missing length check on forwarded PTP messages allows a remote attacker to trigger information disclosure, crash, or potentially remote code execution. Affected are linuxptp versions prior to 3.1.1, 2.0.1, 1.9.3, 1.8.1, 1.7.1, 1.6.1, and ...

CVE-2021-44227

GNU Mailman 2.1.x prior to 2.1.38 is affected by CVE-2021-44227, allowing a list member or moderator to obtain a CSRF token and craft an admin request that can change settings or reset the admin password, potentially leading to admin takeover. Multiple advisories confirm the issue across distribu...

CVE-2022-0943

CVE-2022-0943 affects Vim/vim before 8.2.4563. The vulnerability is described as a heap-based buffer overflow in Vim. The connected documents confirm this CVE is listed among Vim-related issues, but do not provide a detailed root cause or exploit specifics beyond the heap-based overflow. Remediat...

CVE-2023-5169

CVE-2023-5169 (Firefox/Thunderbird) involves a compromised content process that could feed malicious data into PathRecording, causing an out-of-bounds write and potentially a crash in a privileged process. Affected products include Firefox <118, Firefox ESR <115.3, and Thunderbird

CVE-2013-4449

OpenLDAP OpenLDAP rwm overlay vulnerability CVE-2013-4449 allows a remote attacker to crash slapd by unbinding immediately after a search, due to incorrect reference counting. Public disclosures confirm the affected versions (2.4.23, 2.4.36 and earlier) and describe a denial-of-service condition ...

CVE-2018-2677

CVE-2018-2677 affects Oracle Java SE and Java SE Embedded (AWT). A vulnerability in the Java SE/JRE AWT component could allow an unauthenticated attacker with network access to cause a partial denial of service on affected Java deployments (client sandboxed usage). Affected versions per descripti...

CVE-2019-17042

CVE-2019-17042 affects RSYSLOG 8.1908.0 where a heap overflow occurs in the Cisco log message parser (contrib/pmcisconames/pmcisconames.c). The parser miscomputes length when strings don’t meet the delimiter constraint, causing lenMsg to reach -1 and enabling a faulty memmove/shift, which leads t...

CVE-2019-20479

The CVE-2019-20479 issue affects mod_auth_openidc before 2.4.1, caused by insufficient validation of URLs beginning with a slash and backslash, leading to an Open Redirect vulnerability in logout URLs. Multiple connected advisories (Debian, Red Hat/CentOS, Fedora, Amazon Linux advisories) confirm...

CVE-2019-2101

CVE-2019-2101 affects the Android kernel as described in the connected advisories. The vulnerability is caused by an out-of-bounds read in the function uvc_parse_standard_control within uvc_driver.c , resulting from improper input validation. This can lead to local information disclosure without ...

CVE-2019-5807

CVE-2019-5807 is a memory corruption issue in the V8 JavaScript engine in Google Chrome/Chromium prior to 74.0.3729.108. The vulnerability exists in V8’s handling of crafted HTML pages, potentially enabling heap corruption and remote code execution through a page load. Remediation across affected...

CVE-2019-5840

CVE-2019-5840 is a vulnerability tied to Google Chrome/Chromium where an incorrect security UI in the iOS popup blocker allowed bypassing navigation restrictions via a crafted HTML page. Public sources in Debian/Gentoo advisories specify that fixes were delivered by updating Chromium/Chrome to ne...

CVE-2019-7572

SDL (Simple DirectMedia Layer) up to versions 1.2.15 and 2.x up to 2.0.9 has a buffer over-read in IMA_ADPCM_nibble (audio/SDL_wave.c), with additional related issues (e.g., heap-based over-reads/overflows in MS_ADPCM_decode, InitMS_ADPCM, InitIMA_ADPCM, and other SDL components) cited across mul...

CVE-2019-9631

CVE-2019-9631 affects Poppler 0.74.0, with a heap-based buffer over-read in CairoRescaleBox.cc downsample_row_box_filter. The vulnerability is disclosed across multiple advisories (e.g., MiracleLinux AXSA-2019-4277, SUSE/SUSE-SU advisories, Oracle Linux ELSA-2019-2022) and is tracked in CVE-2019-...

CVE-2020-11758

CVE-2020-11758 affects OpenEXR before 2.4.1 via an out-of-bounds read in ImfOptimizedPixelReading.h. Public docs (Debian DLA-2358-1) note potential denial of service and possible arbitrary code execution when processing malformed EXR files; OpenEXR/ImageIO entries reference the same CVE family. R...

CVE-2020-11760

CVE-2020-11760 affects OpenEXR before 2.4.1. There is an out-of-bounds read during RLE uncompression in ImfRle.cpp (function rleUncompress). OpenEXR releases indicate the fix is to upgrade to v2.4.1. Public references in the connected documents confirm the CVE entry is included among OpenEXR issu...

CVE-2020-35498

CVE-2020-35498 is a vulnerability in Open vSwitch caused by an implementation flaw in userspace packet parsing. A specially crafted network packet can cause the kernel megaflow to be overly wide, potentially leading to a denial of service and affecting availability. Concrete references indicate m...