XStream is vulnerable to a Remote Command Execution attack

XStream is vulnerable to an Arbitrary Code Execution attack

A Server-Side Forgery Request vulnerability in XStream via PriorityQueue unmarshaling

A Server-Side Forgery Request vulnerability in XStream via HashMap unmarshaling

XStream is vulnerable to an Arbitrary Code Execution attack

XStream is vulnerable to an Arbitrary Code Execution attack

XStream is vulnerable to an Arbitrary Code Execution attack

XStream is vulnerable to an Arbitrary Code Execution attack

XStream is vulnerable to an Arbitrary Code Execution attack

XStream is vulnerable to an Arbitrary Code Execution attack

XStream is vulnerable to an Arbitrary Code Execution attack

XStream is vulnerable to an Arbitrary Code Execution attack

XStream is vulnerable to an Arbitrary Code Execution attack

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection

An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in the way users use mirroring (replication of files with NFS)

An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found in the way users have access to some less privileged process…

A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write()

net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 through 5.6.10 allows local users to gain privileges because of a heap out-of-bounds write

An out-of-bounds memory write flaw was found in the Linux kernel's joystick devices subsystem in versions before 5.9-rc1, in the way the user calls ioctl JSIOCSBTNMAP

In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary…

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects

A flaw was found in python

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes

In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information leak because of certain use of a hash table which, although big, doesn't…

In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is…

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage

The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression)

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line…

In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL pointer dereference

Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window…

Apache Tomcat: Request header mix-up between HTTP/2 streams

A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP…

Command Injection

An out-of-bounds (OOB) memory read flaw was found in the Qualcomm IPC router protocol in the Linux kernel

A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a race condition

lxml is a library for processing XML and HTML in the Python language

A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and…

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a…