CVE-2021-41819

CVE-2021-41819 affects Ruby and the CGI::Cookie.parse function; Ruby up to 2.6.8 (and CGI gem up to 0.3.0) mishandle security prefixes in cookie names, enabling cookie-prefix spoofing. Public advisories confirm this and list affected Ruby versions across multiple distributions (AL2, AL2 Ruby3.0 e...

CVE-2021-41817

CVE-2021-41817 is a Ruby-related ReDoS in Date parsing. The vulnerability affects Ruby’s date parsing pathways (notably date parsing methods) up to versions around 3.2.0, enabling denial-of-service via crafted date strings. The fixed releases cited in the sources are 3.2.1, 3.1.2, 3.0.2, and 2.0....

CVE-2021-4028

CVE-2021-4028 is a Linux kernel use-after-free in the RDMA communications manager listener path. Local attackers could crash the system or potentially escalate privileges by exploiting a high-port socket listen use-after-free. The vulnerability is documented across multiple connected sources (Deb...

CVE-2020-14147

The CVE-2020-14147 issue is a vulnerability in Redis: an integer overflow in the getnum function of lua_struct.c on Redis builds before 6.0.3 can be triggered by processing large numbers in Lua code, leading to memory corruption, a denial of service (application crash), and potentially bypassing ...

CVE-2021-4166

CVE-2021-4166 is a Vim vulnerability categorized as an out-of-bounds read affecting Vim buffers. Public references in the connected documents confirm the issue, with remediation guidance tied to Vim updates. The Cloud Foundry advisory (USN-6026-1) and related AWS/Linux bulletins indicate Vim fixe...

CVE-2009-0949

CVE-2009-0949 affects CUPS before 1.3.10. The ippReadIO function in cups/ipp.c within cupsd fails to properly initialize memory for IPP request packets, enabling a remote attacker to trigger a denial of service (NULL pointer dereference and cupsd crash) via a scheduler request containing two cons...

CVE-2016-1683

CVE-2016-1683 affects libxslt prior to 1.1.29, as used in Google Chrome before 51.0.2704.63. The issue arises from numbers.c in libxslt, where namespace nodes are mishandled, enabling a remote attacker to trigger out-of-bounds heap memory access and cause a denial of service (with potential unspe...

CVE-2016-1691

CVE-2016-1691 affects the Skia library used by Google Chrome prior to 51.0.2704.63. The issue arises from mishandling of coincidence runs in SkOpCoincidence.cpp and SkPathOpsCommon.cpp, enabling a remote attacker to trigger a heap-based buffer overflow and cause a denial of service (with possible...

CVE-2010-0013

CVE-2010-0013 affects Pidgin (libpurple) via the MSN protocol plugin, specifically the slp.c code path handling custom smiley requests. A directory traversal vulnerability in an MSN emoticon request (.. in filename) could allow remote attackers to read arbitrary files on the affected host. Root c...

CVE-2016-1690

CVE-2016-1690 affects Google Chrome Autofill: the interaction between field updates and JavaScript that triggers a frame deletion allows remote attackers to cause a use-after-free DoS (and possibly other impact) via a crafted website. Affected versions are prior to 51.0.2704.63 (and related advis...

CVE-2016-1700

CVE-2016-1700 concerns Google Chrome/Chromium up to version 51.0.2704.79, where extensions/renderer/runtime_custom_bindings.cc does not account for side effects when creating an array of extension views. This can lead to a use-after-free in extensions, with the primary consequence described as a ...

CVE-2013-4480

CVE-2013-4480 affects Red Hat Satellite 5.6 and earlier. The root cause is that the web interface used to create the initial administrator user was not disabled after setup, enabling a remote attacker to create an admin account. Documented impact is the potential for unauthorized administrative a...

CVE-2016-9957

Summary: CVE-2016-9957 corresponds to a stack-based buffer overflow in the Game Music Emu library prior to version 0.6.1. Multiple connected advisories (Gentoo GLSA-201707-02, Fedora advisories) describe a remotely triggerable condition: a user could be enticed to open a specially crafted SPC mus...

CVE-2016-7966

CVE-2016-7966 affects KDE’s KMail plaintext viewer. A crafted URL containing a quote character can inject HTML code due to the URL parser’s handling, limiting inclusion of characters like = or space, but allowing an HTML comment indicator to hide content. This creates a potential HTML injection r...

CVE-2016-9958

CVE-2016-9958 affects Game Music Emu, prior to version 0.6.1. The vulnerability enables a remote attacker to cause arbitrary memory writes, potentially enabling arbitrary code execution or DoS when opening a crafted SPC file. Public sources (Gentoo GLSA 201707-02 and related advisories) instruct ...

CVE-2016-1656

CVE-2016-1656 relates to Google Chrome for Android prior to 50.0.2661.75, where the download implementation allowed a remote attacker to bypass intended Android file-path restrictions. The issue arises from the download path handling in Chrome’s Android component, enabling bypass of pathname rest...

CVE-2016-9959

CVE-2016-9959 affects Game Music Emu prior to 0.6.1. The vulnerability allows a remote attacker to cause out-of-bounds 8-bit values in SPC/music processing, as described by NVD. Consequences are stated as enabling potential arbitrary behavior from crafted inputs; exploitation details are not prov...