CVE-2019-10160

CVE-2019-10160 relates to a security regression in Python where parsing user-supplied URLs could cause leakage of host-related data (cookies, authentication data) by abusing URL components. The issue affects multiple Python releases (2.7, 3.5, 3.6, 3.7 and pre-3.8.0a4–3.8.0b1) and is tied to URL ...

CVE-2015-2808

CVE-2015-2808 concerns RC4 usage in TLS/SSL within OpenJDK/OpenJDK components. The Invariance Weakness (Bar Mitzvah) means RC4 key material can leak partial plaintext from the first bytes of a TLS/SSL stream, enabling plaintext-recovery under certain traffic patterns. Public advisories for OpenJD...

CVE-2020-26137

CVE-2020-26137 pertains to Python’s urllib3 and is explicitly described as a CRLF injection vulnerability in the HTTP request handling of urllib3/http.client. The connected advisories show affected package and version details: python-urllib3 1.24.2-2 (CBLMariner entry) and a recommended upgrade t...

CVE-2023-43804

CVE-2023-43804 affects the Python urllib3 library, where a Cookie header may be leaked across cross-origin redirects if redirects are not disabled. The issue is resolved in urllib3 1.26.17 or 2.0.5. Affected environments are confirmed in multiple reports, including AlmaLinux and Brocade advisorie...

CVE-2020-36518

CVE-2020-36518 affects jackson-databind prior to 2.13.0, enabling a Java StackOverflow and DoS via excessive nesting depth. In affected advisories, remediation is to upgrade jackson-databind to 2.13.0+ (examples show 2.13.x or newer such as 2.13.4.2 in Crowd/CWD references). Practical impact is d...

CVE-2012-2750

CVE-2012-2750 refers to an unspecified vulnerability in MySQL 5.5.x before 5.5.23 with unknown impact and attack vectors related to a Security Fix (Bug #59533). The description notes this may be a duplicate of CVE-2012-1689, and Oracle had not commented on that possibility as of 2012-08-16. Sever...

CVE-2013-4559

lighttpd prior to 1.4.33 is vulnerable because it does not check the return values of setuid, setgid, or setgroups, which can cause the server to continue running as root on restart and allow privilege escalation (illustrated by repeated clone calls where setuid fails). The issue is tracked acros...

CVE-2021-25122

CVE-2021-25122 affects Apache Tomcat across multiple lines: 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, and 8.5.0 to 8.5.61. The issue allows duplicating request headers and a limited amount of request body from one request to another, enabling cross-user visibility of results (information disclosur...

CVE-2023-46604

CVE-2023-46604 – Apache ActiveMQ OpenWire deserialization RCE has concrete details in connected sources: the Java OpenWire protocol marshaller is vulnerable to remote code execution. A remote attacker with network access to a Java-based OpenWire broker or client can execute arbitrary shell comman...

CVE-2021-4197

CVE-2021-4197 is a Linux kernel vulnerability in the cgroup process migration permission checks. A local attacker could escalate privileges due to incorrect permission validation for cgroup-associated processes (affecting both cgroup v1 and v2). The issue is described across multiple sources as a...

CVE-2022-31626

CVE-2022-31626 affects PHP with mysqlnd/pdo_mysql: buffer overflow when an adversary supplies a long password during host connection, potentially enabling remote code execution. Affected: PHP 7.4.x < 7.4.30, 8.0.x < 8.0.20, 8.1.x

CVE-2019-1559

OpenSSL vulnerability CVE-2019-1559 describes a padding-oracle weakness where, if an application encounters a fatal protocol error and then calls SSL_shutdown() twice (to send close_notify and to receive one), the server may respond differently to a 0-byte record with invalid padding versus inval...

CVE-2020-25686

CVE-2020-25686 affects dnsmasq prior to version 2.83. The flaw: when receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new one, allowing up to 150 outstanding queries and enabling an off-path attacker to substantially reduce the work needed...

CVE-2013-4590

CVE-2013-4590 affects Apache Tomcat prior to 6.0.39, 7.x prior to 7.0.50, and 8.x prior to 8.0.0-RC10. The issue is an XML External Entity (XXE) vulnerability that lets an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld document containing an external entity declar...

CVE-2020-25717

CVE-2020-25717 affects Samba: an authenticated user mapping domain users to local users can lead to privilege escalation. Public references in Connected documents confirm this is a Samba issue (no exploit details provided here). Several advisories and vendor notes indicate patches or updated pack...

CVE-2021-33909

CVE-2021-33909 affects the Linux kernel’s filesystem layer (fs/seq_file.c) across 3.16–5.13.x, with fixed releases in 5.13.4 and via patches noted in downstream advisories. The root cause is a size_t-to-int conversion that permits an integer overflow during seq buffer allocations, enabling an Out...

CVE-2016-7103

CVE-2016-7103 is a cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0, exploitable via the closeText parameter of the Dialog widget. The issue allows remote script/HTML injection. Remediation per connected documents is to upgrade to jQuery UI 1.12.0 or later (fixed version).

CVE-2020-7068

CVE-2020-7068 affects PHP’s phar_parse_zipfile when processing PHAR archives. The flaw allows a use-after-free on freed memory, potentially causing a crash or information disclosure. Affected versions: PHP 7.2.x below 7.2.33, 7.3.x below 7.3.21, and 7.4.x below 7.4.9. Remediation details present ...

CVE-2021-20277

CVE-2021-20277 affects Samba’s libldb. The flaw: multiple leading spaces in an LDAP attribute trigger an out-of-bounds write, crashing the LDAP server process and impacting availability. Connected advisories show affected packages and that a remediation exists via updated libldb versions (e.g., v...

CVE-2023-3079

Summary (CVE-2023-3079) : A type confusion in V8 in Google Chrome prior to 114.0.5735.110 can allow remote code execution via a crafted HTML page, with heap corruption as the underlying issue. The vulnerability affects Chrome’s Chromium-based rendering stack (V8 engine) and is rated High severity...

CVE-2021-24122

CVE-2021-24122 affects Apache Tomcat across multiple branches (7.0.x, 8.5.x, 9.x, 10.x). Root cause: JSP source disclosure when serving resources from a network/NTFS location due to JRE File.getCanonicalPath() and FindFirstFileW behavior. Affected versions include 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1...

CVE-2023-2650

CVE-2023-2650 describes a potential Denial of Service caused by extremely slow translation of large ASN.1 OBJECT IDENTIFIERs via OBJ_obj2txt(), affecting OpenSSL-based workflows and related subsystems. Connected docs confirm multiple vendors reference this issue and link patches or updated packag...

CVE-2025-38236

CVE-2025-38236 concerns a Linux kernel af_unix use-after-free involving consecutive consumed OOB skbs in unix_stream_read_generic(), triggered when OOB data is read but the corresponding skb remains on the recv queue. The root cause is the handling of consumed OOB skbs and the SO_PEEK_OFF path, w...

CVE-2019-9514

CVE-2019-9514 corresponds to an HTTP/2 vulnerability where an attacker floods a peer by sending HEADERS frames, causing unbounded memory growth and potential DoS. Public details in connected advisories show affected stacks include Go HTTP/2 implementations and Go-based tools, with remediation via...

CVE-2022-22817

CVE-2022-22817 affects Pillow’s PIL.ImageMath.eval before 9.0.0, enabling evaluation of arbitrary expressions (including code execution) via the expression parameter; a workaround/change was introduced in Pillow 9.0.0 to restrict builtins. Upgrading to 9.0.0+ (per Pillow release notes) is the adv...

CVE-2009-1891

CVE-2009-1891 affects the Apache HTTP Server mod_deflate in 2.2.x (notably 2.2.11 and earlier). The issue causes CPU consumption DoS by compressing large files even after the client connection closes. Public advisories across distributions confirm the flaw and its remediation via updated packages...

CVE-2019-20916

The CVE-2019-20916 issue affects the Python pip package prior to 19.2. It enables Directory Traversal when a URL is provided in an install command due to a Content-Disposition header containing ../ in a filename, demonstrated by overwriting /root/.ssh/authorized_keys. The vulnerability is in _int...

CVE-2018-8014

CVE-2018-8014 affects the default configuration of Tomcat’s CORS filter, where default settings enable supportsCredentials for all origins across multiple releases (9.0.0.M1–9.0.8, 8.5.0–8.5.31, 8.0.0.RC1–8.0.52, 7.0.41–7.0.88). The issue is that environments relying on the default CORS configura...

CVE-2023-24998

CVE-2023-24998 arises from Apache Commons FileUpload not limiting the number of request parts, enabling a DoS via a malicious upload or series of uploads. The described issue notes that the related file-count limit (FileUploadBase#setFileCountMax) is not enabled by default and must be configured ...

CVE-2018-20406

CVE-2018-20406 affects Python’s pickle handling: an integer overflow in Modules/_pickle.c when resizing with a large LONG_BINPUT can cause memory exhaustion. The issue is triggered when serializing tens-to-hundreds of gigabytes of data via pickle. Affected Python versions include older 3.x branch...

CVE-2025-47273

CVE-2025-47273 affects setuptools by a path traversal in PackageIndex prior to 78.1.1, allowing writing files to arbitrary locations with the process’s permissions and potentially enabling remote code execution in context. Affected: setuptools package (Python ecosystem). The issue is fixed in ver...

CVE-2021-21702

In PHP, the SOAP extension is vulnerable to a null-pointer dereference when a SOAP server returns malformed XML, potentially crashing the interpreter. Affected versions are PHP 7.3.x < 7.3.27, 7.4.x < 7.4.15, and 8.0.x

CVE-2023-0266

CVE-2023-0266 is a use-after-free in the Linux kernel’s ALSA PCM subsystem. The vulnerability arises because SNDRV_CTL_IOCTL_ELEM_READ32/WRITE32 paths lack proper locking, enabling a use‑after‑free that can lead to privilege escalation to ring0 from a system user. Affected material points to the ...

CVE-2024-22201

Technical details about CVE-2024-22201 are not provided in the Connected documents. The Initial entry mentions affected Jetty versions and a patch, but does not supply root-cause analysis, exact vulnerable components, exploit details, or comprehensive mitigations. Monitor for updates.

CVE-2020-7064

CVE-2020-7064 is a PHP EXIF parsing vulnerability: when exif_read_data() processes EXIF data, malicious input may cause PHP to read one byte of uninitialized memory, enabling information disclosure or a crash. Affected are PHP 7.2.x below 7.2.9, 7.3.x below 7.3.16, and 7.4.x below 7.4.4. The issu...

CVE-2019-13638

CVE-2019-13638 affects GNU patch up to version 2.7.6. It enables OS shell command injection when processing a crafted patch file containing an ed-style diff payload with shell metacharacters; the ed editor need not be present on the target system. Multiple connected advisories confirm vulnerable ...

CVE-2019-9639

CVE-2019-9639 affects the PHP EXIF extension: uninitialized read in exif_process_IFD_in_MAKERNOTE (data_len mishandling) on PHP < 7.1.27, < 7.2.16, and

CVE-2016-3427

CVE-2016-3427 is an unspecified vulnerability in Oracle Java SE (affecting 6u113, 7u99, 8u77) and JRockit, tied to the Java Management Extensions (JMX) component. Exploitation can affect confidentiality, integrity, and availability via JMX-related vectors; the issue is described as an unspecified...

CVE-2020-26116

CVE-2020-26116 affects Python’s http.client/httplib in 3.x releases. The issue allows CRLF injection when an attacker controls the HTTP request method, demonstrated by inserting CR/LF into the first argument of HTTPConnection.request. Affected versions include Python 3.x before 3.5.10, 3.6.x befo...

CVE-2021-2163

CVE-2021-2163 applies to Oracle/OpenJDK libraries across Java SE, Java SE Embedded and GraalVM Enterprise Edition. Affected versions include Java SE 7u291, 8u281, 11.0.10, 16; Java SE Embedded 8u281; GraalVM EE 19.3.5, 20.3.1.2 and 21.0.0.2. The vulnerability is exploitable remotely over multiple...

CVE-2021-23358

CVE-2021-23358 concerns the Underscore.js package. Multiple connected documents confirm the vulnerability affects versions up to 1.13.0-2 and earlier than 1.13.0-2 (e.g., 1.3.2 and 1.12.1 and prior), describing Arbitrary Code Injection via the template function when a variable property is passed ...

CVE-2021-3449

CVE-2021-3449 affects OpenSSL 1.1.1.x where a TLSv1.2 server may crash (DoS) if it receives a renegotiation ClientHello that omits the signature_algorithms extension but includes signature_algorithms_cert. The issue is a NULL pointer dereference leading to a denial of service; OpenSSL clients are...

CVE-2019-12525

CVE-2019-12525 affects Squid (3.3.9–3.5.28 and 4.x–4.7). When Digest authentication is used, Proxy-Authorization parsing may treat a single quote as valid and memcpy with length−1, causing memory corruption. Connected advisories confirm the issue and reference updates to Squid versions; however e...

CVE-2021-39144

CVE-2021-39144 refers to a remote code execution vulnerability in XStream, a Java library for XML serialization. When processed input streams are manipulated, an attacker with sufficient rights could execute arbitrary commands on the host. Public descriptions consistently note that XStream now us...

CVE-2020-8617

CVE-2020-8617 involves ISC BIND and is triggered by a logic error in the TSIG validity check (tsig.c). A remote attacker who can guess or know the TSIG key name could cause the server to reach an inconsistent state or trigger an assertion failure, leading to a denial of service. Several connected...

CVE-2017-14496

CVE-2017-14496: dnsmasq contains an integer underflow in the EDNS0 add_pseudoheader handling when --add-mac, --add-cpe-id, or --add-subnet is used, allowing a denial of service via crafted DNS requests. Public advisories (CentOS/RH, Arch Linux, AWS ALAS) and Arista note fixes, with upgrades to dn...

CVE-2019-9638

CVE-2019-9638 affects PHP’s EXIF component. Root cause: uninitialized read in exif_process_IFD_in_MAKERNOTE due to mishandling maker_note->offset/value_len. Affected versions: PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Impact is potential arbitrary code execution on the sy...

CVE-2012-0031

CVE-2012-0031 affects Apache HTTP Server 2.2.21 and earlier, specifically scoreboard.c. The vulnerability allows local users to cause a denial of service (daemon crash during shutdown) or potentially other unspecified impact by modifying a type field in a shared scoreboard Memory segment, which l...

CVE-2018-3639

CVE-2018-3639 is a speculative execution side‑channel vulnerability (SSB) that can leak memory via speculative stores. The Connected ALMA doc notes a mitigation: SSB is disabled by the new alt-java launcher, reducing impact at the cost of performance, and it references OpenJDK 8u282 as part of th...

CVE-2020-11080

In nghttp2, CVE-2020-11080 is a denial-of-service vulnerability caused by an overly large HTTP/2 SETTINGS frame payload in versions before 1.41.0. A PoC repeatedly sends a 14,400-byte SETTINGS frame (2400 settings entries), spiking CPU. The issue is mitigated by upgrading to nghttp2 1.41.0 or lat...