CVE-2021-28041

The CVE refers to OpenSSH ssh-agent before 8.5, where a double-free vulnerability may be triggered in rare scenarios (unconstrained agent-socket access on legacy OS or forwarding to an attacker-controlled host). Affected component: ssh-agent in OpenSSH prior to 8.5. Root cause: double free descri...

CVE-2021-23336

CVE-2021-23336 affects Python CPython across multiple branches (0 and before 3.6.13; 3.7.0 before 3.7.10; 3.8.0 before 3.8.8; 3.9.0 before 3.9.2). The vulnerability is Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs using parameter cloaking with semicolons, causing the pr...

CVE-2019-16168

CVE-2019-16168 affects SQLite up to version 3.29.0, whereLoopAddBtreeIndex in sqlite3.c may crash a browser/application due to missing validation of sqlite_stat1 sz, described as a severe division by zero in the query planner. Connected documents show multiple advisories referencing the fix in SQ...

CVE-2021-22191

CVE-2021-22191 affects Wireshark up to versions 3.4.3 and 3.2.11 (pre-release fix), with vulnerability described as improper URL handling that can enable remote code execution via crafted packets or capture files. The root cause, as reported in connected sources, involves how certain URL fields i...

CVE-2019-19553

Wireshark CMS dissector crash (CVE-2019-19553). Affected: Wireshark 3.0.0–3.0.6 and 2.6.0–2.6.12. Root cause: CMS ContentInfo dissection could leave a non-NULL object identifier, leading to a crash. Remedy: set the object identifier to NULL after ContentInfo dissection in epan/dissectors/asn1/cms...

CVE-2021-22173

Wireshark 3.4.0–3.4.2 has a memory leak in the USB HID dissector that can cause denial of service via crafted captures or packet injection (CVE-2021-22173). Related advisories also reference CVE-2021-22174 (USB HID dissector crash) and other CVEs in the 3.4.x series. Some vendor advisories (e.g.,...

CVE-2021-22174

Wireshark CVE-2021-22174 affects Wireshark 3.4.0–3.4.2, where a crash in the USB HID dissector can cause a denial of service via crafted captures or packet injections. Remediation per connected advisories is to upgrade to a version with fixes (e.g., Wireshark 3.4.6 or later; 3.4.3–3.4.6 lines app...

CVE-2021-1993

CVE-2021-1993 affects Oracle Database Server’s Java VM component. Affected versions: 12.1.0.2, 12.2.0.1, 18c, 19c. An attacker with Create Session via Oracle Net and low privileges, requiring user interaction, can impact data integrity by compromising Java VM. CVSSv3.1 base score 4.8 (I), vector ...

CVE-2021-1999

CVE-2021-1999 affects Oracle ZFS Storage Appliance Kit (Oracle Systems) in the RAS subsystems with version 8.8. The vulnerability allows a high-privilege attacker who has local logon to compromise the kit, requiring user interaction. Attacks can lead to unauthorized creation, deletion, or modific...

CVE-2021-2147

Oracle ZFS Storage Appliance Kit Installation (8.8) has CVE-2021-2147. The vulnerability allows a high-privileged attacker who can log on to the infrastructure running the kit, with required user interaction, to perform unauthorized updates/insertions/deletions of data accessible by the kit. The ...

CVE-2018-1165

CVE-2018-1165 affects Joyent SmartOS release-20170803 (and related SmartOS builds) with a heap-based buffer overflow in the SMB_IOC_SVCENUM IOCTL. The root cause is missing validation of user-supplied data length before copying to a fixed-length heap buffer, enabling a local attacker who can run ...

CVE-2021-2149

CVE-2021-2149 affects Oracle ZFS Storage Appliance Kit Core 8.8. The vulnerability allows a low-privilege attacker with local access to potentially perform unauthorized updates, insertions, or deletions of data within the Oracle ZFS Storage Appliance Kit. Root cause details are tied to the Core c...