CVE-2020-11017

CVE-2020-11017 affects FreeRDP (

CVE-2024-47698

CVE-2024-47698 (Linux kernel) affects DVB frontends rtl2830/rtl2832 in the media/dvb-frontends subsystem. The issue is an out-of-bounds write in the pid_filter logic for rtl2832, caused by not enforcing the maximum index on bit manipulations (dev->filters is 32-bit; indices must be 0–31). The ...

CVE-2009-3614

Liboping 1.3.2 is affected by CVE-2009-3614 due to an input validation error that allows reading arbitrary files on the local system. The connected documents reiterate this description but do not provide further technical details (such as affected functions, vectors, or patch versions). No exploi...

CVE-2014-0460

CVE-2014-0460 is an IBM-related vulnerability described as flaws in the JNDI DNS service provider that can enable spoofing DNS responses, impacting confidentiality and integrity (partial). Exploitation status is not indicated in the IBM bulletins. Affected IBM product: IBM System Networking Switc...

CVE-2015-7942

CVE-2015-7942 affects libxml2 and describes a denial-of-service/ crash caused by a heap-based buffer issue in the xmlParseConditionalSections function when parsing crafted XML data, leading to an out-of-bounds read. The initial document provides concrete details: vulnerable component is libxml2 (...

CVE-2015-9542

CVE-2015-9542 affects pam_radius, where add_password in pam_radius_auth.c (pam_radius 1.4.0) does not properly check the input password length, leading to a stack-based buffer overflow during memcpy. This could crash the loading application and, depending on the host program, C library, and compi...

CVE-2016-4483

CVE-2016-4483 is a libxml2 serialization bug: xmlBufAttrSerializeTxtContent can trigger an out-of-bounds read when a non-UTF-8 attribute value is serialized, leading to a denial of service. Connected records note related follow-ons: CVE-2016-9598 (and CVE-2016-9596) describe DoS/out-of-bounds sce...

CVE-2017-10118

CVE-2017-10118 affects Oracle Java SE/JRockit/JCE with a timing-channel vulnerability in ECDSA within the JCE component. A remote attacker could potentially recover private keys by observing timing differences, enabling unauthenticated network-remote exploitation on affected OpenJDK/JRockit confi...

CVE-2017-5203

CVE-2017-5203 affects tcpdump: a buffer overflow in the BOOTP parser (print-bootp.c:bootp_print()) exists in tcpdump before 4.9.0. Several connected advisories confirm this family of issues and indicate the fix is to upgrade to tcpdump 4.9.0 or later. The CentOS advisory and Debian/Arch Linux sec...

CVE-2017-8105

CVE-2017-8105 affects FreeType 2 and earlier (up to 2017-03-24 release), with an out-of-bounds heap write in t1_decoder_parse_charstrings (psaux/t1decode.c). Connected sources confirm remote code execution risk and/or denial of service in several Linux distributions; impacted packages include fre...

CVE-2018-19198

CVE-2018-19198 (uriparser) is an out-of-bounds write vulnerability in UriQuery.c triggered by mishandling the '&' character in certain contexts, affecting uriparser up to version 0.9.0. The issue is fixed in uriparser 0.9.0 and later (see multiple advisories: USNs/EULAs and vendor advisories refe...

CVE-2018-19491

Gnuplot 5.2.5 is affected by CVE-2018-19491 in the postscript terminal backend. The vulnerability occurs in the PS_options function due to a missing size check on an argument passed to set font, enabling a buffer overflow when arbitrary data is supplied. The issue is localized to the postscript b...

CVE-2018-19539

CVE-2018-19539 (JasPer 2.0.14) : An access violation in libjasper/base/jas_image.c:jas_image_readcmpt can cause a denial of service. Affected component is jas_image_readcmpt in JasPer 2.0.14; root cause is an access violation leading to crash/DoS. Public remediation/fix details are not provided i...

CVE-2018-7254

WavPack 5.1.0 is affected by multiple header parsing weaknesses in the CLI parsers. Specifically, ParseRiffHeaderConfig (riff.c), ParseDsdiffHeaderConfig (dsdiff.c), and ParseCaffHeaderConfig (caff.c) can mis-handle unknown or malformed chunk data, leading to remote-denial-of-service via buffer o...

CVE-2020-14152

The CVE-2020-14152 issue affects libjpeg (IJG JPEG): in djpeg, jpeg_mem_available() does not honor the max_memory_to_use setting, which can lead to excessive memory usage. Connected documents corroborate the same description (e.g., Azure Linux/fltk advisory references) for versions prior to 9d. N...

CVE-2020-27763

CVE-2020-27763 is rejected and not a valid vulnerability entry.

CVE-2020-2933

CVE-2020-2933 is a DoS vulnerability in Oracle MySQL Connector/J. Affected are MySQL Connector/J versions 5.1.48 and earlier. Debian/DSA and CNVD entries reference a fix path: upgrade to 5.1.49 (or later) to remediate. The public docs do not provide the exact root cause or exploitation details be...

CVE-2020-6400

CVE-2020-6400 refers to an inappropriate CORS implementation in Google Chrome prior to 80.0.3987.87, enabling a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability affects Chrome’s cross-origin resource sharing handling and is addressed by updating to Chrome 80.0....

CVE-2020-6547

CVE-2020-6547 affects Google Chrome/Chromium with an incorrect security UI issue in media that could allow a remote attacker to glean sensitive information via a crafted HTML page. The Debian advisory for chromium lists CVE-2020-6547 among multiple fixes and states the fix version as chromium 84....

CVE-2020-6574

CVE-2020-6574 affects Chromium-based Chrome on macOS before 85.0.4183.102, due to insufficient policy enforcement in the installer that could allow a local privilege-escalation via a crafted binary. Several connected advisories confirm the issue and cite upgrades to at least 85.0.4183.102 (or lat...

CVE-2021-0089

CVE-2021-0089 concerns an observable response discrepancy in some Intel processors that could let an authorized local user potentially disclose information. The connected sources corroborate that this is a processor/CPU issue affecting Intel CPUs and related Xen/Citrix contexts, with the primary ...

CVE-2021-21169

CVE-2021-21169 is a real vulnerability: an out-of-bounds memory access in the V8 JavaScript engine used by Chromium/Chrome. Connected advisories confirm the issue affects Chromium before version 89.0.4389.72 and has been fixed in newer Chrome/Chromium releases. Debian Security Advisories and Arch...

CVE-2021-21180

CVE-2021-21180 is a use-after-free vulnerability in Google Chrome’s tab search component, allowing a remote attacker to potentially trigger heap corruption via a crafted HTML page. The publicly documented impact is a remote code execution/heap corruption risk, with the vulnerability existing in C...

CVE-2021-45958

CVE-2021-45958 affects UltraJSON (ujson) up to version 5.1.0, with a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode). Exploitation could crash the application by using excessive indentation. Publicly documented references include Debian LTS (DLA-2929-1) and Mageia...

CVE-2022-1619

CVE-2022-1619 is a heap-based buffer overflow in Vim's cmdline_erase_chars (vim/vim) before version 8.2.4899. The vulnerability can crash Vim, corrupt memory, and potentially enable remote code execution. The connected Astra Linux bulletin confirms the same technical detail. The provided document...

CVE-2022-32209

CVE-2022-32209 affects rails-html-sanitizer: if an application overrides allowed_tags to include both 'select' and 'style', a cross-site scripting (XSS) vulnerability may be exploitable. The issue is triggered when developers configure sanitizer via Rails config, sanitize helper, or SafeListSanit...

CVE-2022-33742

Summary: CVE-2022-33742 is tied to Linux Block and Network PV frontends leaking data due to sharing memory regions without zeroing and because grant-table granularity may expose data within the same 4K page as data shared with a backend. This is described alongside related CVEs (CVE-2022-26365, C...

CVE-2022-3599

LibTIFF 4.4.0 is affected by CVE-2022-3599 due to an out-of-bounds read in writeSingleSection of tools/tiffcrop.c:7345, enabling denial-of-service via a crafted TIFF file. The publicly documented fix is included in commit e8131125, and multiple advisories (Debian DSA/DLA, AlmaLinux security updat...

CVE-2022-45188

CVE-2022-45188 affects Netatalk up to version 3.1.13, where a heap-based buffer overflow in afp_getappl allows code execution via a crafted .appl file, enabling remote root access on some platforms (e.g., FreeBSD used by TrueNAS). Public advisories (Gentoo GLSA, Debian/Ubuntu/DLA notices, Fedora)...

CVE-2023-2468

CVE-2023-2468 matches multiple sources reporting an insecure implementation in Chrome’s PictureInPicture feature. The vulnerability arises from an inappropriate implementation in PictureInPicture, which allowed a remote attacker who had compromised the renderer process to obfuscate the security U...

CVE-2024-0753

CVE-2024-0753: Affects Firefox before 122, Firefox ESR before 115.7, and Thunderbird before 115.7. In certain HSTS configurations, a subdomain could bypass the upper-domain HSTS policy. Public documents from Astra Linux, Debian LTS, and Red Hat/ALAS advisories confirm this as a subdomain HSTS byp...

CVE-2024-1936

The Thunderbird email client (versions earlier than 115.8.1 ) is vulnerable to a flaw where the encrypted subject of an email message can be incorrectly and permanently assigned to another arbitrary email in the local cache . This could lead to a user accidentally leaking confidential subjects to...

CVE-2024-36939

CVE-2024-36939 affects the Linux kernel nfs subsystem. Root cause: rpc_proc_register() errors in init_nfs_fs() could be ignored, causing nfs_net_exit() to run during netns destruction and trigger warning paths. The issue was addressed by properly handling the rpc_proc_register() error in nfs_net_...

CVE-2012-5829

CVE-2012-5829 is a heap-based buffer overflow in the nsWindow::OnExposeEvent function affecting Mozilla Firefox before 17.0, Firefox ESR before 10.0.11, Thunderbird before 17.0, Thunderbird ESR before 10.0.11, and SeaMonkey before 2.14. Connected documents confirm this vulnerability across multip...

CVE-2016-10195

CVE-2016-10195 affects libevent’s evdns.c name_parse function, where handling of label_len can trigger an out-of-bounds stack read. The vulnerability exists in libevent up to version prior to 2.1.6-beta, and is described as having unspecified impact for remote attackers via the label_len-related ...

CVE-2016-2047

CVE-2016-2047 affects multiple MySQL-compatible products. The root cause is failure to verify server hostname against CN/SAN in X.509 certificates, enabling MITM by crafted certificates. Affected: MariaDB prior to 5.5.47, 10.0.x prior to 10.0.23, 10.1.x prior to 10.1.10; Oracle MySQL 5.5.48 and e...

CVE-2016-2533

CVE-2016-2533 affects Pillow and PIL prior to versions that fix the ImagingPcdDecode function in PcdDecode.c. A crafted PhotoCD file can cause a remote denial of service (crash) due to a buffer overflow in Pillow before 3.1.1 and PIL 1.1.7 and earlier. In all connected sources, the vulnerability ...

CVE-2017-10111

CVE-2017-10111 affects Oracle Java OpenJDK’s Libraries component (Java SE). The connected advisories confirm vulnerable versions include Java SE 8u131 and Java SE Embedded 8u131, with exploitation described as arbitrary code execution via the LambdaFormEditor bounds checks in the Libraries, enabl...

CVE-2017-14632

Xiph.Org libvorbis 1.3.5 is vulnerable to CVE-2017-14632: remote code execution via freeing uninitialized memory in vorbis_analysis_headerout() when vi->channels

CVE-2017-17787

CVE-2017-17787 affects GIMP 2.8.22, describing a heap-based buffer over-read in read_creator_block within plug-ins/common/file-psp.c. The available connected documents show multiple distributions documenting this issue and note that a security update exists (e.g., openSUSE security update openSUS...

CVE-2017-5447

CVE-2017-5447 is an out-of-bounds read in glyph widths processing during text layout that can cause a crash and potentially expose memory. Affected products include Mozilla Thunderbird (<52.1) and Mozilla Firefox/Firefox ESR (ESR <52.1; Firefox

CVE-2017-7791

CVE-2017-7791: A data: protocol-based modal alert spoofing vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox

CVE-2017-7798

The CVE-2017-7798 issue is a XUL injection vulnerability in Firefox Developer Tools (style editor) caused by improper sanitization of the web page source. A malicious page could trigger arbitrary code execution via the style editor, affecting Firefox ESR versions <52.3 and Firefox

CVE-2018-16878

CVE-2018-16878 (and related Pacemaker issues) affect Pacemaker up to v2.0.1. Concrete items in connected docs: CVE-2018-16877 (insufficient local IPC client-server authentication enabling local privesc), CVE-2018-16878 (insufficient verification enabling DoS via uncontrolled process preference), ...

CVE-2018-17101

CVE-2018-17101 affects LibTIFF 4.0.9, with two out-of-bounds writes in cpTags (tiff2bw.c and pal2rgb.c) that can crash the application or have other unspecified impact when processing crafted TIFF images. Affected/affected-family advisories show upstream fixes; remediation is to upgrade LibTIFF t...

CVE-2018-6003

CVE-2018-6003 affects GNU Libtasn1 (libtasn1) with unlimited recursion in _asn1_decode_simple_ber in decoding.c, leading to stack exhaustion and DoS. Affected product: Cloud Pak for Security (CP4S) versions 1.8.1.0, 1.8.0.0, 1.7.2.0. Remediation: upgrade to CP4S 1.9.0.0. See remediation guidance ...

CVE-2019-20163

GPAC 0.8.0 and 0.9.0-development-20191109 expose a NULL pointer dereference in gf_odf_avc_cfg_write_bs() (odf/descriptors.c). The CVE-2019-20163 entry is documented across multiple feeds; no exploitation details are provided in the core text. Upstream fixes and distro advisories indicate remediat...

CVE-2020-11048

CVE-2020-11048 : In FreeRDP, versions up to and including 2.0.0 contain an out-of-bounds read that can abort a session (no data exfiltration). The issue is fixed in 2.0.0. Connected advisories confirm the same CVE entry and remediation, reinforcing that upgrading to 2.0.0+ eliminates the vulnerab...

CVE-2020-16001

CVE-2020-16001 is a use-after-free vulnerability in Chrome’s media component (video/multimedia stack) that could allow remote code execution via a crafted HTML page. It was fixed in the Chromium/Chrome stable channel with version 86.0.4240.111. The associated advisory notes this as a high-severit...

CVE-2020-16008

CVE-2020-16008 affects Chromium/WebRTC prior to 86.0.4240.183. The root cause is a stack-based buffer overflow in the WebRTC component that could allow a remote attacker to trigger stack corruption and arbitrary code execution. Remediation is to upgrade Chromium to version 86.0.4240.183 or newer ...