Eval injection vulnerability in the Module-Metadata module before 1.000015 for Perl allows remote attackers to execute arbitrary Perl code via the $Version value

A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before…

An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library

libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow

libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow

In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistake introduced in commit…

python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass

In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "identityref"

An issue was discovered in amqp_handle_input in amqp_connection.c in rabbitmq-c 0.9.0

A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver

A heap-based buffer overflow was discovered in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver

A heap-based buffer overflow vulnerability was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver

An issue was discovered in Squid before 4.9

An issue was discovered in phpMyAdmin before 4.9.2

An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7

An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the…

Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have…

ClamAV before 0.97.7 has buffer overflow in the libclamav component

ClamAV before 0.97.7 has WWPack corrupt heap memory

Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous…

libpoe-component-irc-perl before v6.32 does not remove carriage returns and line feeds

The plural form formula in ngettext family of calls in php-gettext before 1.0.12 allows remote attackers to execute arbitrary code

An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests

An issue was discovered in Xen through 4.12.x allowing 32-bit PV guest OS users to gain guest OS privileges by installing and using descriptors

systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS

GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB threshold is exceeded

Libntlm through 1.5 relies on a fixed buffer size for tSmbNtlmAuthRequest, tSmbNtlmAuthChallenge, and tSmbNtlmAuthResponse read and write operations, as demonstrated by a…

An issue was discovered in Rsyslog v8.1908.0

An issue was discovered in Rsyslog v8.1908.0

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10

An issue was discovered in net/wireless/nl80211.c in the Linux kernel through 5.2.17

OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 is prone to a signature-bypass vulnerability with multiple From: addresses, which might affect applications that consider a…

process_http_response in OpenConnect before 8.05 has a Buffer Overflow when a malicious server uses HTTP chunked encoding with crafted chunk sizes

Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3

Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10

A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass…

In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings

mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0

AdPlug 2.3.1 has a double free in the Cu6mPlayer class in u6m.h

LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is…

LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is…

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4

An issue was discovered in The Sleuth Kit (TSK) 4.6.6

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of…

OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow

An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to…

Gnome Pango 1.42 and later is affected by: Buffer Overflow