CVE-2024-6387

CVE-2024-6387 is a remote code-execution vulnerability in OpenSSH’s server (sshd) caused by a race condition in a signal handler that may run after a client fails to authenticate within LoginGraceTime. The issue is exploitable by an unauthenticated, remote attacker on glibc-based Linux systems, p...

CVE-2023-52433

CVE-2023-52433: Linux kernel netfilter nft_set_rbtree vulnerability. New elements in a single transaction may expire before the transaction ends; skip sync GC during the transaction to avoid the commit path traversing an already released object. Async GC will collect expired elements after the tr...

CVE-2021-3156

CVE-2021-3156 is a heap-based buffer overflow in sudo that enables privilege escalation to root. The issue arises in the argument parsing path and is exploitable via commands using sudoedit -s with a trailing backslash, leading to memory corruption. Affected release information in the provided do...

CVE-2024-6119

OpenSSL CVE-2024-6119 causes a denial of service when applications perform certificate name checks (e.g., TLS server name validation). The issue stems from reading an invalid memory address during name comparison (e.g., otherName in X.509) and may terminate the process. Multiple connected advisor...

CVE-2024-34750

CVE-2024-34750 affects Apache Tomcat across multiple lines of the 9.x, 10.x, and 11.x series, where improper handling of HTTP/2 streams leads to miscounting active streams and the use of an infinite timeout, allowing connections to remain open. Root cause: during HTTP/2 processing, Tomcat fails t...

CVE-2024-47554

CVE-2024-47554 affects Apache Commons IO. An Uncontrolled Resource Consumption issue in XmlStreamReader may cause high CPU use when processing malicious input. Vulnerable version range: 2.0 <= v

CVE-2024-38286

The CVE-2024-38286 entry describes an Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat that, under certain configurations, allows an attacker to trigger an OutOfMemoryError by abusing the TLS handshake. Affected versions include Tomcat 11.0.0-M1 through 11.0.0-M...

CVE-2025-0167

The CVE-2025-0167 issue affects curl (libcurl) and arises when both using a .netrc for credentials and following HTTP redirects. The root cause, as described across connected documents, is that the netrc entry can omit login and password (or a default entry omits both), which may allow the passwo...

CVE-2024-26633

CVE-2024-26633 affects the Linux kernel’s ip6_tunnel code, specifically the NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim(). Syzbot reported that frag_off could be read before enough bytes were pulled into skb->head, causing reads of uninitialized or garbage data. The issue is exposed...