In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for…

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Smart Card IO)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security)

An issue was discovered in the Linux kernel through 5.6.11

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms

fs/nfs/nfs4client.c in the Linux kernel before 5.13.4 has incorrect connection-setup ordering, which allows operators of remote NFSv4 servers to cause a denial of service (hanging…

gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c in the Linux kernel 3.16 through 5.6.13 relies on kstrdup without considering the possibility of an internal '\0' value,…

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAX-WS)

There is a use-after-free in kernel versions before 5.5 due to a race condition between the release of ptp_clock and cdev while resource deallocation

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Javadoc)

When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly

An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta

0-byte record padding oracle

An error handling synthesized records could cause an assertion failure when using DNS64 with "break-dnssec yes;"

An error processing RPZ rules can cause named to loop endlessly after handling a query

Timing attack against ECDSA signature generation

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE)

btrfs in the Linux kernel before 5.13.4 allows attackers to cause a denial of service (deadlock) via processes that trigger allocation of new system chunks during times when there…

An issue was discovered in the Linux kernel through 5.6.11

An issue was discovered in the Linux kernel before 5.4.17

An issue was discovered in the Linux kernel before 4.8

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI)

The VFIO PCI driver in the Linux kernel through 5.6.13 mishandles attempts to access disabled memory space

named exits with a REQUIRE assertion failure if it receives a null command string on its control channel

In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Serialization)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAX-WS)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries)

Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: Serialization)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: 2D)

A race problem was seen in the vt_k_ioctl in drivers/tty/vt/vt_ioctl.c in the Linux kernel, which may cause an out of bounds read in vt as the write access to vc_mode is not…

It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes

drivers/net/wireless/ath/ath6kl/usb.c in the Linux kernel through 5.2.9 has a NULL pointer dereference via an incomplete address in an endpoint descriptor

A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking)

When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server…

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)

netrc and default credential leak

An issue was discovered in the Linux kernel before 4.18.7

An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security)