A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection

napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization)

Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Python)

NetApp OnCommand Workflow Automation before 3.1P2 allows remote attackers to bypass authentication via unspecified vectors

Ppmd7.c in 7-Zip before 23.00 allows an integer underflow and invalid read operation via a crafted 7Z archive

In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize

A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as…

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication)

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate)

Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol

A flaw was found in undertow

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep…

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested…

A flaw was found in Undertow

A flaw was found in Undertow

A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects

In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memory

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line…

libcurl-using applications can ask for a specific client certificate to be used in a transfer

ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL…

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”

While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access…

The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly

MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support…

A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session

regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls

Segmentation fault in SSL_check_chain

Vulnerability in the Java SE product of Oracle Java SE (component: JSSE)

The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream

The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data

dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element

In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file…

Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in…

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Installer)

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection…

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot)

CA certificate check bypass with X509_V_FLAG_X509_STRICT

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D)

The c_rehash script allows command injection

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer)