CVE-2020-14330

CVE-2020-14330 (Ansible) is an Improper Output Neutralization for Logs flaw in the uri module that can expose sensitive data in logs/output, including keys from playbooks, affecting confidentiality. The vulnerability affects Ansible Engine/uri usage with local access; no exploit details are provi...

CVE-2020-16287

Ghostscript v9.50 is affected by a buffer overflow in lprn_is_black() (contrib/lips4/gdevlprn.c) that could allow a remote attacker to cause a denial of service via a crafted PDF. The issue is fixed in Ghostscript v9.51. Suggested action: upgrade to 9.51 or later. CVSS data present in the provide...

CVE-2020-16304

Ghostscript (Artifex) v9.18–v9.50 contains a buffer overflow in image_render_color_thresh() in base/gxicolor.c that could allow a remote attacker to escalate privileges via a crafted EPS file. The issue is addressed in v9.51. Connected sources corroborate the vulnerability in Ghostscript and refe...

CVE-2020-25665

CVE-2020-25665 affects ImageMagick’s PALM image coder (coders/palm.c). The vulnerability arises from an improper call to AcquireQuantumMemory() in WritePALMImage() that should offset by 256; this can lead to an out-of-bounds read later in the routine. The fix patches the call by adding 256 to byt...

CVE-2020-28030

Wireshark’s GQUIC dissector (in versions 3.2.0–3.2.7) contains a crash risk due to incorrect offset advancement in epan/dissectors/packet-gquic.c. The vulnerability was fixed by correcting the implementation of offset advancement. Public references from Debian and Arch Linux advisories confirm th...

CVE-2020-6474

CVE-2020-6474 is a use-after-free in Blink/WebKit within Chromium/Google Chrome before version 83.0.4103.61. The issue can allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. Affected component is Blink/WebKit (Chromium-based browsers). The connected sources co...

CVE-2020-6531

CVE-2020-6531 describes a side-channel information leakage in Chrome/Chromium’s Scroll to Text feature. A crafted HTML page could allow a remote attacker to leak cross-origin data. Public details indicate the issue affects Chrome/Chromium versions prior to 84.0.4147.89, with Debian noting a fix i...

CVE-2020-6568

CVE-2020-6568 affects Google Chrome on Android prior to 85.0.4183.83, where insufficient policy enforcement in the intent handling could allow a remote attacker to bypass navigation restrictions via a crafted HTML page. The issue is tied to Chrome/Chromium ecosystem; Debian/Fedora advisories refe...

CVE-2021-20228

CVE-2021-20228 affects Ansible Engine 2.9.18 where sensitive info is not masked by default and not protected by no_log when using the basic.py sub-option, impacting confidentiality. Multiple connected advisories confirm the issue and note updates/patches: IBM ESS (fix to 6.0.2.1), Debian security...

CVE-2022-0909

CVE-2022-0909 affects libtiff 4.3.0 and its tiffcrop component, caused by a division-by-zero in computeOutputPixelOffsets() that can crash the application via a crafted TIFF file (DoS). Public advisories (Arch Linux ASA-202204-6, ALAS/ALAS2, Debian DSA-5108-1) indicate fixes in libtiff 4.3.0-2 or...

CVE-2022-20771

The CVE-2022-20771 issue affects the ClamAV TIFF file parser. It is a denial-of-service vulnerability that could be exploited by an unauthenticated, remote attacker by processing a crafted TIFF file. Affected versions include ClamAV 0.104.0–0.104.2 and the LTS line 0.103.5 and earlier. Public adv...

CVE-2022-20785

CVE-2022-20785 affects ClamAV HTML file parser. Vulnerable versions: 0.1040–0.1042 and LTS 0.103.5 and earlier. Condition: unauthenticated remote attacker can cause a denial-of-service on the affected device. Description points to the ClamAV blog for details; no exploit specifics are provided in ...

CVE-2022-24807

Net-snmp vulnerability CVE-2022-24807: A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can lead to an out-of-bounds memory access. Exploitable by a user with read-write credentials. A fix was released in Net-SNMP 5.9.2. Recommendation: upgrade to 5.9.2 or newer; use s...

CVE-2022-2598

CVE-2022-2598 affects Vim where an out-of-bounds write to the API in vim/vim occurs in versions before 9.0.0100. Public advisories in the connected docs (e.g., Alpine and CBL-Mariner) indicate an upgrade to a newer Vim version to resolve this issue (CLI-safe wording: upgrade to 9.0.0100 or later)...

CVE-2022-26306

CVE-2022-26306 affects The Document Foundation LibreOffice (7.2.x before 7.2.7; 7.3.x before 7.3.1). The vulnerability = static initialization vector used to encrypt web connection passwords stored in the user configuration database, weakening the encryption if an attacker gains access to the con...

CVE-2022-32087

CVE-2022-32087 affects MariaDB Server in versions 10.2 through 10.7, where processing of certain SQL statements can trigger a segmentation fault in Item_args::walk_args. The connected advisories (ALAS2023-037, ALAS2MARIADB10.5-2023-003, Debian DLA-3114-1, Debian/Red Hat trackers) confirm this as ...

CVE-2022-45060

CVE-2022-45060 – Varnish Cache HTTP/2 header forgery affects Varnish Cache 5.x and 6.x up to before 6.0.11, 7.x up to before 7.1.2, and 7.2.x up to before 7.2.1. An attacker can inject characters in HTTP/2 pseudo-headers that are invalid for HTTP/1 request lines, causing the Varnish server to gen...

CVE-2023-2858

The CVE-2023-2858 issue is a NetScaler file parser crash in Wireshark, reported for Wireshark versions 4.0.0–4.0.5 and 3.6.0–3.6.13, allowing a denial-of-service via crafted capture files. Connected advisories confirm the root cause is a parser crash in the NetScaler file parser within Wireshark....

CVE-2023-52686

CVE-2023-52686 involves a Linux kernel vulnerability where a null pointer check is missing in powerpc/powernv opal_event_init() and kasprintf() can return NULL on allocation failure. Exploitation could lead to a denial of service via NULL pointer dereference; this has been addressed with a kernel...

CVE-2023-6861

The CVE-2023-6861 issue is a heap buffer overflow in nsWindow::PickerOpen(void) when Firefox/Thunderbird run in headless mode. Affected products: Firefox ESR <115.6, Thunderbird <115.6, and Firefox

CVE-2024-0750

CVE-2024-0750 affects Firefox (versions prior to 122) and Thunderbird (prior to 115.7), with the issue described as a bug in popup notifications delay calculation that could allow a user to be tricked into granting permissions. Connected advisories confirm the vulnerability and link it to Mozilla...

CVE-2024-25189

The CVE concerns libjwt: 1.15.3 uses strcmp (not constant time) to verify authentication, enabling a timing side‑channel bypass. Connected sources confirm this is a legitimate vulnerability with high impact (CVE-2024-25189) and note Debian LTS advisories and Debian/DLA entries recommending an upg...

CVE-2024-27059

CVE-2024-27059 refers to a Linux kernel vulnerability in the usb-storage isd200 sub-driver. The issue arises from using ATA ID values HEADS and SECTORS to derive cylinder/head for READ/WRITE CDBs; division/modulus by zero could occur if either value is 0. The fix blocks binding to devices with AT...

CVE-2024-47698

CVE-2024-47698 (Linux kernel) affects DVB frontends rtl2830/rtl2832 in the media/dvb-frontends subsystem. The issue is an out-of-bounds write in the pid_filter logic for rtl2832, caused by not enforcing the maximum index on bit manipulations (dev->filters is 32-bit; indices must be 0–31). The ...

CVE-2025-37789

CVE-2025-37789 (net: openvswitch: fix nested key length validation in the set() action) is covered by connected advisories, which confirm a Linux kernel vulnerability in netlink key length handling for the set() action in Open vSwitch. The description notes that accessing nla_len(ovs_key) is unsa...

CVE-2014-9584

CVE-2014-9584 affects the Linux kernel where the function parse_rock_ridge_inode_internal in fs/isofs/rock.c does not validate a length value in the ER System Use Field, enabling local users to obtain sensitive kernel memory via a crafted iso9660 image. This vulnerability exists in kernels before...

CVE-2015-0383

CVE-2015-0383 relates to an unspecified local vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4/R28.3.4, with impact to integrity and availability via Hotspot, as per the initial description. Connected documents reference multiple Java/Op...

CVE-2015-7702

CVE-2015-7702 affects ntpd’s crypto_xmit implementation in NTP 4.2.x before 4.2.8p4 and 4.3.x before 4.3.77, allowing remote attackers to crash ntpd (DoS). The issue stems from an incomplete fix for CVE-2014-9750. Public advisories note the vulnerability and that updates have been released (e.g.,...

CVE-2016-5300

Expat CVE-2016-5300 is a denial-of-service vulnerability in the Expat XML parser caused by insufficient entropy used for hash initialization. The issue allows context-dependent attackers to cause CPU exhaustion via crafted identifiers in XML documents. Connected material confirms this as an Expat...

CVE-2016-9898

CVE-2016-9898 is a use-after-free vulnerability in Mozilla Firefox/Thunderbird affecting Firefox <50.1, Firefox ESR <45.6, and Thunderbird

CVE-2017-2520

CVE-2017-2520 (SQLite, affected Apple OSes) is a vulnerability where a crafted SQL statement could cause a buffer overflow, enabling remote code execution or a denial of service. Affected products/versions (from provided sources): Apple iOS <10.3.2, macOS <10.12.5, tvOS <10.2.1, watchOS

CVE-2017-5407

CVE-2017-5407 describes a information-disclosure flaw in SVG filters due to floating-point timing side channels that can leak pixel data and history across origins. Affected products include Mozilla Firefox and Thunderbird versions older than 52 (Firefox ESR older than 45.8; Thunderbird older tha...

CVE-2017-5408

CVE-2017-5408: Cross-origin reading of video captions in Mozilla products due to missing CORS header checks. Affected: Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, Thunderbird

CVE-2017-5445

CVE-2017-5445 describes a memory-read vulnerability in Mozilla products when parsing the application/http-index-format content, caused by uninitialized values used to create an array. The impact is information disclosure by reading uninitialized memory in affected components. Affected versions pe...

CVE-2017-7784

The CVE-2017-7784 issue is a use-after-free in the image observer during frame reconstruction after the observer has been freed, affecting Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox

CVE-2017-7867

CVE-2017-7867 is a heap-based buffer overflow in ICU for C/C++, caused by an out-of-bounds write in utf8TextAccess and utext_setNativeIndex*, leading to potential remote code execution or denial of service. The IBM bulletin (and related reports) confirm the flaw affects ICU prior to 2017-02-13 an...

CVE-2018-1000115

CVE-2018-1000115 – Memcached UDP amplification vulnerability. Memcached 1.5.5 contains an Insufficient Control of Network Message Volume (CWE-406) in UDP support, enabling a remote attacker to perform a denial-of-service via UDP traffic to port 11211 (amplification ~1:50,000). The issue is mitiga...

CVE-2018-14660

CVE-2018-14660 : A flaw in GlusterFS server (versions up to 4.1.4 and 3.1.2) lets a remote, authenticated attacker repeatedly call setxattr on GF_META_LOCK_KEY to create multiple locks for a single inode, leading to memory exhaustion on the GlusterFS server node. Connected documents confirm Glust...

CVE-2018-5129

The CVE-2018-5129 entry relates to a memory-safety/IPC validation issue where a lack of parameter validation on IPC messages can cause an out-of-bounds write, potentially enabling sandbox escape. Affected products include Mozilla Thunderbird < 52.7, Firefox ESR < 52.7, and Firefox

CVE-2018-6767

CVE-2018-6767 affects WavPack 5.1.0, with a stack-based buffer over-read in ParseRiffHeaderConfig (cli/riff.c) that can cause denial of service via crafted RF64 files; related issues in ParseDsdiffHeaderConfig and ParseCaffHeaderConfig can lead to heap/global over-reads or memory corruption in va...

CVE-2019-12221

The CVE-2019-12221 entry corresponds to a NULL/SEGV issue in SDL_free_REAL inside SDL with SDL2_image 2.0.4 (SDL 2.0.9) when used together, as described in the initial document. Connected documents confirm this vulnerability is addressed by SDL2_image updates to 2.0.5 (and corresponding SDL relea...

CVE-2019-13755

CVE-2019-13755 : Google Chrome prior to 79.0.3945.79 suffers from insufficient policy enforcement in extensions, allowing a remote attacker to disable extensions via a crafted HTML page. Connected sources confirm this is a Chrome-extension policy issue, with public fixes in 79.0.3945.79 and later...

CVE-2019-20162

GPAC CVE-2019-20162 affects GPAC 0.8.0 and 0.9.0-development-20191109. The vulnerability is a heap-based buffer overflow in gf_isom_box_parse_ex() (isomedia/box_funcs.c). The provided documents do not specify exploit details, impacted platforms beyond GPAC versions, potential impact (beyond gener...

CVE-2020-0182

CVE-2020-0182 affects libexif, where exif_entry_get_value may perform an out-of-bounds read due to a missing bounds check, enabling local information disclosure without extra privileges. The published advisories and vendor bulletins (e.g., Red Hat RHSA-2020:4040; Debian DLA-2249-1; ALAS2-2020-152...

CVE-2020-10955

GitLab CE/EE 11.1–12.9 is affected by a parameter-tampering flaw in an upload feature that allows an unauthorized user to read content from certain folders. root cause: input validation flaw enabling access to restricted content. Impact: information disclosure. Remediation: upgrade to patched rel...

CVE-2020-16307

Ghostscript (Artifex) vulnerable in version 9.50 due to a null pointer dereference in devices/vector/gdevtxtw.c and psi/zbfont.c, which could allow a remote attacker to cause a denial of service via a crafted PostScript file. The issue is mitigated by upgrading to version 9.51 (as reported by CVE...

CVE-2020-28034

WordPress CVE-2020-28034: A cross-site scripting (XSS) flaw exists in WordPress before 5.5.2 via global variables. The vulnerability affects WordPress core components exposed to user input; exploitation details and exploitability are not provided in the available documents. The fix is addressed i...

CVE-2020-28039

CVE-2020-28039 affects WordPress core, specifically is_protected_meta in wp-includes/meta.php. WordPress versions prior to 5.5.2 are vulnerable due to an incorrect determination of whether a meta key is protected, which allows arbitrary file deletion. The issue is addressed in WordPress 5.5.2 (se...

CVE-2020-6402

CVE-2020-6402 affects Google Chrome on macOS (OS X) prior to 80.0.3987.87, where Insufficient policy enforcement in downloads could let a user who installed a crafted Chrome Extension execute arbitrary code. The root cause is a policy enforcement flaw in the Downloads component, enabling code exe...

CVE-2020-7040

CVE-2020-7040 affects the StoreBackup tool (storeBackup.pl) up to version 3.5, where it relies on the /tmp/storeBackup.lock path. This allows local attackers to perform a symlink attack or create a plain file named /tmp/storeBackup.lock to block usage, potentially leading to privilege escalation ...