A heap memory corruption problem (use after free) can be triggered in libgetdata v0.10.0 when processing maliciously crafted dirfile databases

An issue was discovered in klibc before 2.0.9

An issue was discovered in klibc before 2.0.9

An issue was discovered in klibc before 2.0.9

In BIND 9.5.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.11.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions…

Unbound before 1.9.5 allows an out-of-bounds write via a compressed name in rdata_copy

Unbound before 1.9.5 allows an integer overflow in a size calculation in respip/respip.c

Unbound before 1.9.5 allows an integer overflow in a size calculation in dnscrypt/dnscrypt.c

Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par

Unbound before 1.9.5 allows an integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write

Unbound before 1.9.5 allows an integer overflow in the regional allocator via the ALIGN_UP macro

Unbound before 1.9.5 allows an integer overflow in the regional allocator via regional_alloc

Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to bypass the add_issue_notes permission requirement by leveraging the Issues API

Integer overflow in the htmldoc 1.9.11 and before may allow attackers to execute arbitrary code and cause a denial of service that is similar to CVE-2017-9181

Format string vulnerability in panoFileOutputNamesCreate() in libpano13 2.9.20~rc2+dfsg-3 and earlier can lead to read and write arbitrary memory values

In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors

XStream is vulnerable to an Arbitrary Code Execution attack

XStream is vulnerable to an Arbitrary Code Execution attack

XStream is vulnerable to an Arbitrary Code Execution attack

XStream is vulnerable to an Arbitrary Code Execution attack

Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated

A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1 in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sface() sfh->volume() OOB…

A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1

A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1

A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1

An issue was discovered in SaltStack Salt before 3002.5

An issue was discovered in SaltStack Salt before 3002.5

An issue was discovered in through SaltStack Salt before 3002.5

An issue was discovered in through SaltStack Salt before 3002.5

Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name= substring

xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence

The daemon in GENIVI diagnostic log and trace (DLT), is vulnerable to a heap-based buffer overflow that could allow an attacker to remotely execute arbitrary code on the…

encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write access and application crash) or possibly have unspecified other impact…

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept…

gssproxy (aka gss-proxy) before 0.8.3 does not unlock cond_mutex before pthread exit in gp_worker_main() in gp_workers.c

The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to execute arbitrary code because a filename containing special characters can be…

Prototype Pollution

In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.conf format

ReadyMedia (aka MiniDLNA) before versions 1.3.0 allows remote code execution

Slurm before 19.05.8 and 20.x before 20.02.6 has an RPC Buffer Overflow in the PMIx MPI plugin

prive/formulaires/configurer_preferences.php in SPIP before 3.2.8 does not properly validate the couleur, display, display_navigation, display_outils, imessage, and spip_ecran…

InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka…

The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request

In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens

Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass

is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a…

wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post

WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC

WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php

Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3