CVE-2024-33599

The nscd (Name Service Cache Daemon) binary is vulnerable to a stack-based buffer overflow in the netgroup cache. This flaw occurs when the fixed-size cache is exhausted by client requests, potentially causing a buffer overflow during subsequent requests for netgroup data. The vulnerability was i...

CVE-2024-33600

A null pointer dereference vulnerability exists in the nscd (Name Service Cache Daemon) binary, specifically within the glibc library. The flaw occurs when the cache fails to add a not-found netgroup response to the cache, causing the client request to trigger a crash or daemon exit. This issue w...

CVE-2023-28531

CVE-2023-28531 affects OpenSSH: ssh-add adds smartcard keys to ssh-agent without the intended per‑hop destination constraints, starting from OpenSSH up to version 9.2.x and earliest affected 8.9. The issue is resolved in OpenSSH 9.3 and later. Remediation is upgrading to 9.3+ (or the distro patch...

CVE-2020-8286

The CVE-2020-8286 issue affects curl/libcurl where OCSP responses were not verified correctly against the certificate, leaving room for fraudulent OCSP responses to appear valid and potentially bypass revocation checks. Reported range: curl versions 7.41.0 through 7.73.0. Impact phrasing in cited...

CVE-2022-27776

CVE-2022-27776 is a curl vulnerability where credentials could be leaked during HTTP redirects to the same host on a different port. Root cause: insufficiently protected credentials in redirect handling. Impact: potential exposure of authentication or cookie headers. Affected: curl/libcurl across...

CVE-2020-8284

CVE-2020-8284 affects curl's handling of FTP PASV responses, enabling a malicious FTP server to coax curl into connecting to an attacker-controlled IP/port and potentially reveal private services (port scanning, banner extraction). Affects curl prior to patched versions; multiple advisories refer...

CVE-2020-29368

Affected software: Linux kernel up to version prior to 5.7.5 (pre-5.7.5). Vulnerability details: In mm/huge_memory.c, __split_huge_pmd, the copy-on-write CoW implementation can grant unintended write access due to a race in the THP mapcount check. This race condition can lead to local write acces...

CVE-2020-8285

CVE-2020-8285 is a curl/libcurl vulnerability in the FTP wildcard match parsing. The issue triggers uncontrolled recursion leading to a stack overflow when the internal callback returns CURL_CHUNK_BGN_FUNC_SKIP repeatedly, potentially causing a crash. Affected software includes curl/libcurl from ...

CVE-2022-36879

CVE-2022-36879 affects the Linux kernel: a flaw in xfrm_policy handling (xfrm_expand_policies) can cause a refcount to be dropped twice in net/xfrm/xfrm_policy.c. This is a local vulnerability with an availability impact (as per CVSS: 5.5, MEDIUM). The issue exists through kernel versions up to 5...

CVE-2022-27780

CVE-2022-27780 affects curl: the URL parser can wrongly decode percent-encoded separators in the host portion, causing a URL like http://example.com%2F127.0.0.1/ to be interpreted as http://example.com/127.0.0.1/, potentially bypassing filters. Affected software is curl (core library). The flaw’s...

CVE-2021-38160

CVE-2021-38160 affects the Linux kernel “virtio_console” driver. In drivers/char/virtio_console.c, if an untrusted device supplies a buf->len value larger than the destination buffer, data corruption or loss can occur. The issue is fixed in Linux kernel 5.13.4 (ChangeLog-5.13.4). The vendor no...

CVE-2022-27774

CVE-2022-27774 affects curl. The vulnerability is described as an insufficiently protected credentials issue where credentials could be leaked during HTTP(S) redirects when authentication is involved, potentially leaking to other hosts across different protocols or ports. Connected advisories sho...

CVE-2020-16166

CVE-2020-16166 affects the Linux kernel by allowing remote observers to infer the network RNG internal state via drivers/char/random.c and kernel/time/timer.c. Affected platforms show fixes across multiple distributions: Debian LTS (linux package updates to 4.9.240-1/ -2; multiple CVEs), IBM advi...

CVE-2020-12771

CVE-2020-12771 involves the Linux kernel component drivers/md/bcache/btree.c , where the function btree_gc_coalesce may deadlock if a coalescing operation fails. The connected Unity/Nessus entries reproduce: an issue in the kernel up to 5.6.11 with deadlock in the btree GC coalescing path, impact...

CVE-2024-33602

The Name Service Cache Daemon (nscd) is vulnerable to a memory corruption flaw in its netgroup cache . The issue arises because the cache incorrectly assumes that NSS callbacks use in-buffer strings; if the callback fails to store all strings in the provided buffer, it can lead to memory corrupti...

CVE-2022-27781

CVE-2022-27781 affects libcurl builds using NSS; due to an erroneous function, a malicious server could cause libcurl to enter a never-ending busy-loop when retrieving certificate information, impacting availability. Affected advisories suggest upgrading curl/libcurl to a patched version (e.g., n...

CVE-2024-33601

The Name Service Cache Daemon (nscd) is vulnerable to a denial of service because its netgroup cache utilizes xmalloc or xrealloc functions. These functions may terminate the daemon process upon a memory allocation failure, impacting clients. This flaw was introduced in glibc 2.15 when the cache ...

CVE-2021-38199

CVE-2021-38199 concerns the Linux kernel’s NFSv4 client. The vulnerability arises from incorrect connection-setup ordering in fs/nfs/nfs4client.c, which can be triggered by remote NFSv4 servers during trunking detection, potentially causing a denial of service by hanging mounts. Connected advisor...

CVE-2022-27775

Curl contains an information‑disclosure flaw (CVE-2022-27775) in versions 7.65.0–7.82.0 where an IPv6 address from the pool could be reused with a different zone id, enabling potential leakage through connection reuse. Affected platforms in connected advisories indicate curl/libcurl fixes have be...

CVE-2021-38201

The CVE affects the Linux kernel, specifically net/sunrpc/xdr.c, where an out-of-bounds slab access (xdr_set_page_base) could be triggered by many NFS 4.2 READ_PLUS operations, allowing remote denial-of-service. Affected: Linux kernel versions prior to 5.13.4. Root cause: slab-out-of-bounds acces...

CVE-2022-27779

Summary: CVE-2022-27779 affects curl/libcurl by allowing cookies to be set for Top Level Domains when the hostname ends with a trailing dot. The issue arises in the cookie engine and PSL-aware checks, potentially causing cookies to be sent to an unrelated domain. The connected advisory (ALAS2023-...

CVE-2019-0201

CVE-2019-0201 affects Apache ZooKeeper up to versions 3.4.13 and 3.5.4-beta, where getACL() does not enforce permissions and returns the ACL Id in plaintext. When Digest Authentication is in use, the unsalted hash value contained in the Id field can be disclosed to unauthenticated or unprivileged...

CVE-2022-30115

CVE-2022-30115 describes an HSTS bypass in curl where the client could be forced to use HTTPS despite an HTTP URL, via mismatches between URL hostname trailing dots and HSTS cache entries. Connected advisories confirm the issue affects curl and was fixed in later releases; for example, Alpine/CUR...

CVE-2021-4209

CVE-2021-4209 is a NULL pointer dereference in the GnuTLS library that can cause denial of service after authentication when zero-length input triggers undefined behavior in Nettle hash update paths. The vulnerability is applicable to GnuTLS and has been addressed in vendor advisories and Debian ...

CVE-2021-38202

CVE-2021-38202 affects the Linux kernel before 5.13.4, where fs/nfsd/trace.h can allow remote attackers to trigger a denial-of-service via an out-of-bounds read in strlen when the trace event framework is used for nfsd. The vulnerability is triggered by NFS traffic sent over the network. A fix wa...

CVE-2021-38203

CVE-2021-38203 affects the btrfs component in the Linux kernel, with the issue present in versions before 5.13.4. The root cause is a race condition during allocations of new system chunks when space is scarce in space_info, which can lead to a denial-of-service (deadlock) for local attackers. Pu...

CVE-2023-29153

Intel SPS firmware CVE-2023-29153 affects Intel Server Platform Services prior to SPS_E5_06.01.04.002.0. The issue is uncontrolled resource consumption that may allow a privileged user to cause a denial of service over the network. CVSS 3.1 vector: AV:N/AC:L/PR:H/UI:N/S:U/I:N/A:H (base score 4.9,...