CVE-2017-9287

CVE-2017-9287 affects OpenLDAP slapd back-mdb/search.c and allows a remote crash via a search using Paged Results with page size 0. Public sources in connected docs confirm OpenLDAP versions up to 2.4.44 are affected, with multiple advisories noting a double-free denial-of-service in OpenLDAP and...

CVE-2018-2817

CVE-2018-2817 affects the MySQL/MariaDB server stack (MySQL Server component; subcomponents such as DDL/InnoDB/Optimizer) across multiple product lines. Affected versions include MySQL/MariaDB releases prior to upstream fixes (e.g., 5.5.x, 5.6.x, 5.7.x families as cited in the documents). Impact ...

CVE-2019-19204

Oniguruma 6.x before 6.9.4_rc2 is affected. In regparse.c, fetch_interval_quantifier calls PFETCH without verifying PEND, causing a heap-based buffer over-read. This is documented across multiple advisories (e.g., Debian/ALMALINUX/Amazon Linux) and is fixed in 6.9.4_rc2 and later releases. Affect...

CVE-2019-5775

CVE-2019-5775 corresponds to a vulnerability in Google Chrome’s Omnibox: an incorrect handling of a confusable character enables a remote attacker to spoof the URL bar via a crafted domain name. The issue affects Chrome versions prior to 72.0.3626.81. Exploitation could mislead users by displayin...

CVE-2020-1752

CVE-2020-1752 (glibc) is a use-after-free vulnerability in the tilde expansion path handling of glibc’s glob processing, originating in upstream version 2.14 and fixed in 2.32. The issue affects directory paths beginning with a tilde followed by a valid username and can be exploited by a local at...

CVE-2020-35662

SaltStack Salt before 3002.5 does not consistently validate SSL certificates during authentication with certain modules. Affected: Salt (SaltStack Salt) core; root cause: SSL certificate validation is bypassed/not consistently enforced. Impact: potential exposure of credentials or sensitive data ...

CVE-2020-36224

CVE-2020-36224 is an OpenLDAP vulnerability present in OpenLDAP releases before 2.4.57. It can cause a denial of service due to an invalid pointer free in the saslAuthzTo processing, crashing slapd. A fix is available in OpenLDAP 2.4.57 and later; upgrade to a version at or beyond that release (v...

CVE-2023-2269

The CVE-2023-2269 entry concerns a denial-of-service vulnerability in the Linux kernel Device Mapper-Multipathing, caused by a possible recursive locking scenario that can deadlock in table_clear() in drivers/md/dm-ioctl.c. Affected component: Linux kernel’s DM‑multipath subsystem. Impact per the...

CVE-2024-12426

CVE-2024-12426 concerns LibreOffice up to version 24.8.3 (impacted) with an exposure vulnerability where URLs could cause environmental variables and arbitrary INI file values to be exfiltrated to a remote server when opening certain documents. Affected component/issue: exporting sensitive enviro...

CVE-2014-3538

CVE-2014-3538 affects the file utility: multiple flaws found in the file regular expression rules used to detect file types can cause denial of service via CPU exhaustion when processing crafted inputs; this issue is tied to an incomplete previous fix (CVE-2013-7345). Affected data shows updated ...

CVE-2015-1819

The CVE-2015-1819 entry is supported by connected data showing a deterministic DoS in libxml2 via XML Entity Expansion (XEE) during XML parsing, causing memory exhaustion. Amazon Linux 2 advisory ALAS2-2019-1220 explicitly groups CVE-2015-1819 with several libxml2 DoS/memory-related CVEs and inst...

CVE-2017-3302

CVE-2017-3302 describes a crash in libmysqlclient.so when the server connection is lost, affecting Oracle MySQL before 5.6.21 and 5.7.x before 5.7.5, and MariaDB up to 5.5.54 and various 10.0/10.1/10.2 branches up to 10.2.3. The vulnerability can impact availability (partial impact per CVSS v2/v3...

CVE-2019-13767

CVE-2019-13767 describes a use-after-free in Chrome’s media picker. A remote attacker who has compromised the renderer could trigger heap corruption via a crafted HTML page in Google Chrome prior to version 79.0.3945.88. The available documents confirm the affected component (media picker/rendere...

CVE-2019-7175

ImageMagick has a confirmed vulnerability CVE-2019-7175: memory leaks in DecodeImage within coders/pcd.c present in affected releases prior to 7.0.8-25. The issue causes memory consumption/exhaustion when processing certain PCX/PCD inputs, with no explicit exploitation details provided in the doc...

CVE-2020-11085

CVE-2020-11085 affects FreeRDP: before version 2.1.0 there is an out-of-bounds read in cliprdr_read_format_list (clipboard format data). This could read memory beyond bounds when processing clipboard formats. The issue has been fixed in FreeRDP 2.1.0. Affected advisories from multiple vendors cor...

CVE-2020-11762

OpenEXR CVE-2020-11762: An out-of-bounds read and write in DwaCompressor::uncompress (ImfDwaCompressor.cpp) occurs when handling the UNKNOWN compression case, affecting versions before 2.4.1. The issue is addressed in OpenEXR 2.4.1 (upgrade recommended).

CVE-2020-25084

CVE-2020-25084 affects QEMU 5.0.0. The issue is a use-after-free in hw/usb/hcd-xhci.c caused by not validating the return value of usb_packet_map. This can lead to memory safety problems within the USB XHCI handling path. The connected documents provide the concrete detail that the bug is tied to...

CVE-2020-28243

CVE-2020-28243 affects SaltStack Salt before 3002.5. The minion’s path restartcheck is vulnerable to command injection via a crafted process name, enabling local privilege escalation for any user who can create files on the minion in a non-blacklisted directory. The issue is documented across mul...

CVE-2021-20312

CVE-2021-20312 — ImageMagick : Affected in ImageMagick 7.0.11 and earlier; an integer overflow in WriteTHUMBNAILImage (coders/thumbnail.c) may trigger undefined behavior, mainly impacting availability. The connected Debian LTS advisory (DLA-3429-1) fixes this family of issues in imagemagick for D...

CVE-2021-23450

CVE-2021-23450 describes a Prototype Pollution vulnerability in the Dojo package, exposed via the setObject function. Multiple connected advisories confirm Dojo is affected and note remediation by upgrading to fixed Dojo versions in vendor advisories (IBM, other vendors) and related security bull...

CVE-2021-3178

CVE-2021-3178 affects the Linux kernel NFSv3 export path: when exporting a subdirectory, READDIRPLUS can leak the parent directory file handle, allowing a client to access files outside the exported subtree. Descriptions note this through kernel 5.10.8; some advisories reference fixes in patched ...

CVE-2022-32084

CVE-2022-32084 affects MariaDB servers (component: sub_select) and is documented to cause a segmentation fault/server crash. The Initial Description notes a vulnerability in MariaDB versions 10.2 through 10.7. Connected advisories reference concrete fixes for this issue in MariaDB-related securit...

CVE-2022-3890

CVE-2022-3890 refers to a heap buffer overflow in Crashpad used by Google Chrome on Android before 107.0.5304.106. The vulnerability could be exploited by a remote attacker who already compromised the renderer process to potentially escape the sandbox via a crafted HTML page. Affected software is...

CVE-2023-5849

CVE-2023-5849 affects Chromium/Google Chrome USB handling: an integer overflow can lead to heap corruption via a crafted HTML page. Impact is high (CVE described as High); exploitation details in the wild are not provided in the documents. Remediation observed in multiple distros includes upgradi...

CVE-2025-43965

ImageMagick’s CVE-2025-43965 affects MIFF image processing where image depth is mishandled after SetQuantumFormat, in builds prior to 7.1.1-44. Affected product: ImageMagick. Root cause: mishandling of image depth during MIFF processing when SetQuantumFormat is used (no additional details provide...

CVE-2016-0747

The CVE-2016-0747 entry affects nginx rescanner behavior: the resolver in nginx (versions prior to 1.8.1 and 1.9.x prior to 1.9.10) does not properly limit CNAME resolution, allowing remote attackers to cause denial of service via excessive name-resolution work. Public details across multiple sou...

CVE-2017-10116

CVE-2017-10116 affects Oracle Java SE / Java SE Embedded / JRockit (OpenJDK-related vulnerabilities also reflected in various advisories). The vulnerability arises in the Security component’s LDAPCertStore where LDAP referrals to arbitrary URLs could be used by an unauthenticated network attacker...

CVE-2017-18241

CVE-2017-18241 affects Linux kernel fs/f2fs/segment.c prior to 4.13. Local users can cause a denial of service via a NULL pointer dereference in a flush_cmd_control when using the noflush_merge option, leading to a panic. No exploitation details are provided in the documents. Remediation: upgrade...

CVE-2017-3651

CVE-2017-3651 affects Oracle MySQL Server’s Client mysqldump component. Affected releases include 5.5.56 and earlier, 5.6.36 and earlier, and 5.7.18 and earlier. The issue is described in multiple advisories as a vulnerability that enables a low-privileged, network-accessing attacker to perform u...

CVE-2018-10877

CVE-2018-10877 describes a vulnerability in the Linux kernel ext4 filesystem where an out-of-bounds access in ext4_ext_drop_refs() can be triggered by operating on a crafted ext4 image. The connected sources indicate a local attacker could mount or otherwise interact with a crafted ext4 image to ...

CVE-2018-14362

CVE-2018-14362 affects Mutt before 1.10.1 and NeoMutt before 2018-07-16. pop.c does not forbid characters that may interact unsafely with message-cache pathnames, demonstrated by a '/' character, creating a path-traversal vulnerability in message-cache handling. No exploitation details are provid...

CVE-2018-16151

CVE-2018-16151 affects strongSwan’s gmp plugin (RSA via GMP). The flaw is in verify_emsa_pkcs1_signature() where excess data after the encoded OID is not rejected during PKCS#1 v1.5 verification, enabling signature forgery when small public exponents are used and RSA is used for IKEv2 authenticat...

CVE-2018-6126

CVE-2018-6126 is a Skia-related heap/buffer overflow in Google Chrome prior to 67.0.3396.62. A precision error in Skia could allow a remote attacker to perform an out-of-bounds memory write via a crafted HTML page, enabling potential arbitrary code execution. Publicly, this vulnerability is track...

CVE-2019-13745

CVE-2019-13745 affects Google Chrome (Chromium) prior to 79.0.3945.79. It is a policy enforcement error in the audio component that could allow a remote attacker to leak cross-origin data via a crafted HTML page. The entry lists the vulnerable condition and version range but does not provide expl...

CVE-2019-13762

CVE-2019-13762 relates to Google Chrome/Chromium on Windows, where insufficient policy enforcement in downloads could allow a local attacker to spoof downloaded files via local code. This is a local, low-severity (CVSS 3.1: 3.3; CVSS 2.0: 2.1) issue with limited impact if exploited. The documente...

CVE-2019-14846

CVE-2019-14846 affects Ansible Engine where all 2.x lines up to 2.8.5 (and similar older branches) could disclose credentials because plugins logging at DEBUG level log sensitive data. The flaw does not affect Ansible modules (they run in a separate process). Public docs show multiple vendors/adv...

CVE-2019-19057

CVE-2019-19057 affects the Linux kernel mwifiex PCIe wireless driver (drivers/net/wireless/marvell/mwifiex/pcie.c). Two memory leaks in mwifiex_pcie_init_evt_ring() can occur through failures in mwifiex_map_pci_memory(), allowing a local attacker to trigger memory consumption and a denial of serv...

CVE-2019-3462

CVE-2019-3462 affects apt 1.4.8 and earlier due to incorrect sanitation of the 302 redirect field in the HTTP transport, enabling content injection by a MITM attacker and potentially leading to remote code execution. Public docs confirm the flaw is in apt’s redirect handling and that exploitation...

CVE-2019-5837

CVE-2019-5837 affects Blink in Google Chrome (Chromium-based) prior to 75.0.3770.80, allowing an remote attacker to leak cross-origin data via a crafted HTML page (information disclosure). Debian security advisories indicate fixes in Chromium packages to 76.0.3809.100+; upgrade to the latest Chro...

CVE-2020-13361

CVE-2020-13361 affects QEMU: es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, allowing guest OS users to trigger an out-of-bounds access during an es1370_write() on QEMU 5.0.0 and earlier. The issue is documented across multiple advisories and vendor response...

CVE-2020-15393

CVE-2020-15393 : The Linux kernel contains a memory leak in usbtest_disconnect (drivers/usb/misc/usbtest.c) affecting 4.4–5.7.6, CID-28ebeb8db770. Connected sources confirm this CVE across multiple distributions and advisories (Debian LTS entries, Amazon Linux advisories, Mageia, etc.). The vulne...

CVE-2020-35490

CVE-2020-35490 : jackson-databind 2.x before 2.9.10.8 is affected. The issue arises from mishandling the interaction between serialization gadgets and typing, related to PerUserPoolDataSource in org.apache.commons.dbcp2. Root cause: polymorphic deserialization/gadget chaining leads to potential c...

CVE-2021-3928

Technical details about CVE-2021-3928 are not provided in the connected documents. Monitor for updates from Debian/Red Hat advisories and vendor advisories for precise root cause, affected versions, and fixes.

CVE-2022-0487

CVE-2022-0487 is a use-after-free in the MOXART SD/MMC Host Controller support driver (memstick) in the Linux kernel. The flaw arises in the driver path rtsx_usb_ms_drv_remove and affects kernel versions older than 5.14-rc1. Local users with limited privileges could exploit this to impact confide...

CVE-2022-3303

CVE-2022-3303 is a race-condition vulnerability in the Linux kernel sound subsystem (SNDCTL_DSP_SYNC ioctl) that can cause a NULL pointer dereference and denial of service via a locally privileged user. The issue affects the Linux kernel’s sound code path and can crash the system, potentially ena...

CVE-2022-33981

CVE-2022-33981 affects the Linux kernel’s floppy driver (drivers/block/floppy.c) up to version 5.17.6. The issue is a concurrency use-after-free after deallocating raw_cmd in the raw_cmd_ioctl function, leading to a local denial-of-service. Public documents confirm the vulnerable code path and th...

CVE-2022-42890

CVE-2022-42890 is a vulnerability in Apache Batik (XML Graphics Project) that allows an attacker to run arbitrary Java code from untrusted SVG via JavaScript. The issue affects Apache Batik prior to version 1.16; multiple advisories note upgrading to 1.16 or newer as the remediation (e.g., Debian...

CVE-2023-3777

CVE-2023-3777 is a use-after-free in Linux kernel nf_tables (netfilter). When nf_tables_delrule() flushes table rules, it may release objects if the chain is bound, enabling local privilege escalation. Mitigation: upgrade past commit 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8 (Linux kernel versions...

CVE-2025-38352

CVE-2025-38352: In the Linux kernel, a TOCTOU race affects posix-cpu-timers between handle_posix_cpu_timers() and posix_cpu_timer_del() when an exiting non-autoreaping task runs from IRQ. The fix adds a tsk->exit_state check into run_posix_cpu_timers() to prevent misdetection of timer->it.c...

CVE-2017-13305

CVE-2017-13305 : A vulnerability described as an information disclosure in the Upstream Linux kernel encrypted-keys, with affected product scope as Android kernels. The Initial CVE text notes Android kernel as the impacted component and Android ID A-70526974, describing a local information disclo...