CVE-2020-4050

CVE-2020-4050 (WordPress) is a vulnerability where misusing the set-screen-option filter’s return value can enable arbitrary user meta fields to be saved. It requires an admin to install a plugin that misuses the filter, after which low-privilege users may exploit it. The issue was fixed in WordP...

CVE-2017-8816

CVE-2017-8816 affects curl/libcurl NTLM authentication on 32-bit platforms, enabling a denial-of-service via integer overflow and buffer overflow when handling long user/password fields. Public advisories tie this to the NTLM path and note exposure through 32-bit builds prior to curl 7.57.0. Amaz...

CVE-2018-19626

Wireshark vulnerability CVE-2018-19626 affects the DCOM dissector in Wireshark 2.6.0–2.6.4 and 2.4.0–2.4.10, where a crash could occur due to improper handling in the dissector. The issue was mitigated by modifying epan/dissectors/packet-dcom.c to add a null terminator, addressing the crash. Conn...

CVE-2018-5764

The CVE concerns rsyncd’s parse_arguments in options.c, where multiple uses of --protect-args are not prevented, allowing remote bypass of the argument-sanitization protection mechanism. Affects rsync prior to 3.1.3 (upstream) and various vendor advisories reference mitigation through upgrading t...

CVE-2019-13757

CVE-2019-13757 describes an incorrect security UI issue in the Omnibox of Google Chrome/Chromium that could enable domain spoofing using IDN homographs. The root cause is a security UI flaw in Omnibox handling of domain name input, allowing spoofed domains to appear legitimate. Public reports and...

CVE-2019-5778

CVE-2019-5778 affects Google Chrome/Chromium extensions. The available description states a missing case in handling special schemes during permission request checks in Extensions, allowing bypass of extension permission checks for privileged pages via a crafted Chrome Extension (pre 72.0.3626.81...

CVE-2019-9495

CVE-2019-9495 affects hostapd and wpa_supplicant with EAP-pwd support; vulnerable due to cache access-pattern side-channel. Astra Linux and other sources reinforce that before 2.10, both hostapd and wpa_supplicant are affected. Impact: potential exposure via side-channel, capable of cracking weak...

CVE-2020-11089

CVE-2020-11089 is an out-of-bounds read in FreeRDP prior to version 2.1.0, affecting the irp functions (parallel_process_irp_create, serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu, serial_process_irp_write). The issue has been fixed in 2.1.0. Affecte...

CVE-2020-13625

PHPMailer prior to 6.1.6 contains an output escaping bug in attachment name handling when the file name includes a double quote, which can cause the file type to be misinterpreted by recipients or mail relays. The CVE is confirmed across multiple advisories and vendor responses (e.g., PHPMailer r...

CVE-2021-20292

CVE-2021-20292 affects the Linux kernel up to version

CVE-2021-20309

CVE-2021-20309 affects ImageMagick prior to 7.0.11 and 6.9.12, where a division by zero in WaveImage() (MagickCore/visual-effects.c) can trigger undefined behavior via crafted images. The highest risk described is impact to availability. Connected advisories/patch notes show fixes in ImageMagick ...

CVE-2021-29338

CVE-2021-29338 is an OpenJPEG 2.4.0 vulnerability: an integer overflow in the OpenJPEG library (openjp2/pi.c / related code paths) can be triggered by a directory with a very large number of files (example: 1,048,576) passed via the -ImgDir option, leading to a denial of service (crash). The issu...

CVE-2023-0666

Wireshark 4.0.x is affected by CVE-2023-0666 due to a RTPS parsing heap overflow in 4.0.5 and earlier. Affected component: RTPS dissector in Wireshark; root cause: failure to validate RTPS packet length. Reported impact includes potential code execution in the Wireshark process and a heap-based o...

CVE-2009-2625

CVE-2009-2625 affects Apache Xerces2-Java (XML parser used by JRE/JDK) where parsing a malformed XML with systems DTD identifiers can cause DoS (hangs), via a vulnerability in SYSTEM handling in Xerces2 Java. Connected advisories confirm public fixes: Debian libxerces2-java updates (DSA-1984-1) a...

CVE-2014-3660

CVE-2014-3660 affects libxml2: parser.c allowed excessive entity expansion (billion laughs) even when entity substitution is disabled, enabling DoS via crafted XML. Public details confirm the vulnerability in libxml2 up to versions before 2.9.2. Affected component is the XML parser (parser.c) in ...

CVE-2017-10087

CVE-2017-10087 is a vulnerability in Oracle Java SE/Java SE Embedded Libraries affecting Java SE 6u151, 7u141, and 8u131, and Java SE Embedded 8u131. The issue is an access-control bypass in the Libraries component that could allow a network-facilitated, unauthenticated attacker to take control o...

CVE-2017-10810

CVE-2017-10810: Linux kernel memory leak in virtio_gpu_object_create (drivers/gpu/drm/virtio/virtgpu_object.c) up to 4.11.8 can cause memory exhaustion and denial of service when object initialisation fails. Connected Nessus advisories (Unity Linux UTSA-2026-002867/002763/000604) reproduce the sa...

CVE-2017-15422

ICU vulnerability CVE-2017-15422: An integer overflow in ICU’s international date handling (ICU for C/C++) enables out-of-bounds memory reads via crafted HTML. Affected: ICU before 60.1; used in Google Chrome’s V8 (pre-63.0.3239.84) and other products. Impact per sources: potential memory disclos...

CVE-2018-16152

The GMP-based RSA implementation in strongSwan is affected by CVE-2018-16151 and CVE-2018-16152: the gmp_rsa_public_key.c ASN.1/algorithm identifiers do not strictly reject excess or NULL parameters in PKCS#1 v1.5 signatures, enabling potential Bleichenbacher-style forgery and impersonation when ...

CVE-2018-16873

CVE-2018-16873 is a Go go get remote code execution vulnerability (GOPATH mode) where a malicious package import path can cause the parent directory to be treated as a Git repository root, leading to execution of commands from the repository’s config if it contains malicious directives. Connected...

CVE-2018-2622

CVE-2018-2622 affects MySQL Server (Server: DDL) with affected versions 5.5.58 and earlier, 5.6.38 and earlier, and 5.7.20 and earlier. It allows a network-based attacker with low privileges to cause a hang or complete denial-of-service. Multiple connected advisories (ALAS-2018-969, CentOS/CESA-2...

CVE-2018-9363

CVE-2018-9363 is a Linux-kernel vulnerability in the HIDP Bluetooth driver: hidp_process_report can overflow a buffer due to incorrect length handling, potentially causing memory corruption and DoS, with possible remote code execution. Public documents across Debian/Ubuntu/CentOS‑related advisori...

CVE-2019-13742

CVE-2019-13742 corresponds to an UI spoof vulnerability in Google Chrome’s Omnibox on iOS, where an incorrect security UI allowed a remote attacker to spoof the URL bar via a crafted domain name prior to version 79.0.3945.79. Connected security advisories reference Chrome/Chromium remediation pat...

CVE-2019-16711

CVE-2019-16711 affects ImageMagick; a memory leak in Huffman2DEncodeImage (coders/ps2.c) is reported for ImageMagick 7.0.8-40, with related entries mentioning Huffman2DEncodeImage in coders/ps3.c (7.0.8-43). The provided connected documents do not include exploitation details or explicit fixes fo...

CVE-2019-3701

CVE-2019-3701 affects the Linux kernel CAN subsystem (can_can_gw_rcv in net/can/gw.c) up to version 4.19.13. The CAN frame modification rules can apply bitwise logic to can_dlc, enabling a privileged user with CAP_NET_ADMIN to create a can-gw rule that makes the DLC larger than the frame data. Wh...

CVE-2020-11810

OpenVPN 2.4.x prior to 2.4.9 is affected by CVE-2020-11810. An attacker can inject a P_DATA_V2 data channel packet using a victim’s peer-id, potentially dropping the victim’s connection if the packet arrives before data channel crypto parameters are initialized. The attack relies on a small timin...

CVE-2020-29568

CVE-2020-29568 affects Xen frontends/backends (Xen 4.14.x and older) where watch events are processed by a single thread. If events arrive faster than handling, the unbounded queue can exhaust backend memory, allowing a guest to trigger an OOM in the dom0 backend. The Xen issue is described in mu...

CVE-2021-29457

Exiv2 before 0.27.4 is affected by a heap-based buffer overflow in Exiv2::Jp2Image::doWriteMetadata when writing metadata to crafted images; could enable code execution. Upgrade to 0.27.4 or later (fixed in upstream).

CVE-2021-30851

CVE-2021-30851 affects WebKitGTK and WPE WebKit. A memory corruption vulnerability could allow arbitrary code execution when processing malicious web content. Upstream fix is WebKitGTK/WebKit/WPE WebKit 2.34.1; Debian/Arch Linux advisories (DSA-4995/4996, ASA-202110-10) note remediation by upgrad...

CVE-2021-45095

CVE-2021-45095 affects the Linux kernel PhoNet (pep_sock_accept in net/phonet/pep.c). Root cause: reference-count leak in certain error paths, enabling memory exhaustion. Affected: Linux kernel up to 5.15.x (examples cite 5.15.8); remediation: patch released, kernels updated to 5.15.18.1-1 (Marin...

CVE-2022-41850

CVE-2022-41850 affects the Linux kernel driver: roccat_report_event in drivers/hid/hid-roccat.c up to version 5.19.12. It describes a race condition that can lead to a use-after-free when a report is received while copying report->value, enabling local attacker impact such as denial of service...

CVE-2023-3773

The CVE-2023-3773 entry describes a flaw in the Linux kernel’s XFRM (IP framework) where parsing netlink attributes can trigger a 4-byte out-of-bounds read of XFRMA_MTIMER_THRESH. This could allow a malicious user with CAP_NET_ADMIN to leak sensitive heap data to userspace. The provided descripti...

CVE-2023-42756

CVE-2023-42756 is a Linux kernel vulnerability in the Netfilter/IPSET subsystem caused by a race between IPSET_CMD_ADD and IPSET_CMD_SWAP that can lead to a kernel panic and local system crash. The description indicates a local attacker may crash the machine due to calling __ip_set_put on a wrong...

CVE-2017-10295

CVE-2017-10295 affects OpenJDK (Java SE/Java SE Embedded) Networking: HttpURLConnection/HttpsURLConnection failed to detect newline characters in URLs, enabling potential HTTP header injection via attacker-provided URLs. Public notices in connected docs show affected package openjdk-7/openjdk-8 w...

CVE-2017-13087

CVE-2017-13087 affects WPA/WPA2 (WPA2) implementations in wpa_supplicant/wpa and is part of the KRACK family. The issue is a GTK reinstallation triggered when processing a Wireless Network Management Sleep Mode Response frame, allowing an attacker within radio range to replay frames between APs a...

CVE-2017-7656

CVE-2017-7656 affects Eclipse Jetty: HTTP/0.9 handling vulnerability in Jetty 9.2.x and older, 9.3.x (all configurations), and 9.4.x with RFC2616 compliance enabled. An HTTP/1 style request line declaring HTTP/0.9 could be treated as a 0.9 request, potentially enabling intermediar y proxies to mi...

CVE-2018-1118

CVE-2018-1118 affects the Linux kernel vhost path used by /dev/vhost-net. The issue is improper memory initialization in vhost/vhost.c:vhost_new_msg(), enabling a local unprivileged user to read kernel memory contents. The vulnerability arises from memory not being initialized before being passed...

CVE-2018-2815

CVE-2018-2815 is a deserialization flaw in Oracle Java SE, Java SE Embedded, and JRockit (Serialization component) that can be exploited over network without authentication to cause a partial denial of service. Affected are Java SE 6u181, 7u171, 8u162, 10; Java SE Embedded 8u161; JRockit R28.3.17...

CVE-2019-13752

CVE-2019-13752: Affected software is Google Chrome/Chromium with SQLite in the WebKit/Blink stack. The issue is an out-of-bounds read in the SQLite library, allowing a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. It affects Chrome/Chromi...

CVE-2019-13759

Google Chrome vulnerable: CVE-2019-13759 stems from incorrect security UI in interstitials that enables domain spoofing via a crafted HTML page. Affected: Chrome versions prior to 79.0.3945.79. Impact: potential spoofing of the address bar/domain in interstitial UI. Mitigation: upgrade to Chrome ...

CVE-2020-16587

OpenEXR 2.3.0 (ImfMultiPartInputFile.cpp, chunkOffsetReconstruction) contains a heap-based buffer overflow that can cause a denial of service when processing a crafted EXR file. Public advisories (e.g., Debian DLA/OpenEXR entries) list CVE-2020-16587 among affected issues and document patched ver...

CVE-2020-6483

CVE-2020-6483 is a Chromium/Chrome vulnerability where an insufficient policy enforcement in the payments component allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Connected advisories confirm this is a Chromium/Chrome issue affecting the payments module and d...

CVE-2021-20313

CVE-2021-20313 is a vulnerability in ImageMagick prior to 7.0.11 describing a potential cipher leak when calculating signatures in TransformSignature, with data confidentiality as the highest concern. The connected advisories (Astra Linux, Debian LTS, Cloud Foundry USNs) confirm ImageMagick invol...

CVE-2021-41229

BlueZ contains a memory-leak vulnerability in the SDP path (sdp_cstate_alloc_buf) that can cause the service to be exhausted if an attacker continuously sends SDP packets. The issue is described across multiple advisories as affecting BlueZ and being mitigated by upgrading to patched BlueZ packag...

CVE-2022-27448

CVE-2022-27448 affects MariaDB Server v10.9 and below. The issue is an assertion failure in the code path node->pcur->rel_pos == BTR_PCUR_ON (row/row0mysql.cc), which can cause a crash (DoS) of MariaDB Server. The provided documents do not specify a fixed version or exact remediation steps....

CVE-2022-42328

Technical details about CVE-2022-42328 (and related CVEs) are not provided in the connected documents. Monitor the cited Xen/XenServer advisories and AWS Amazon/Linux advisories for updates and fixes.

CVE-2023-4349

CVE-2023-4349 : Use after free in Device Trust Connectors in Google Chrome prior to 116.0.5845.96. A remote attacker could potentially exploit heap corruption via a crafted HTML page. Affected product is Chrome (Chromium-based). The issue is addressed by updating to the latest Chrome/Chromium bui...

CVE-2023-43770

Roundcube Webmail vulnerability CVE-2023-43770 is a cross-site scripting (XSS) issue in Roundcube prior to 1.4.14, 1.5.x prior to 1.5.4, and 1.6.x prior to 1.6.3. The root cause is behavior in program/lib/Roundcube/rcube_string_replacer.php that allows XSS via crafted links in text/plain emails, ...

CVE-2005-1921

CVE-2005-1921 is a remote PHP code execution vulnerability in PEAR XML_RPC (<=1.3.0) and PHPXMLRPC (

CVE-2015-9381

FreeType vulnerability CVE-2015-9381 affects FreeType before 2.6.1, with a heap-based buffer over-read in T1_Get_Private_Dict (type1/t1parse.c). This can lead to information disclosure. Connected sources confirm the issue is due to a memory boundary validation flaw in that function. Remediation s...