VMware Spring Cloud Gateway Code Injection Vulnerability

Spring Framework JDK 9+ Remote Code Execution Vulnerability

VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability

NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures

In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string

FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection

An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes

The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression)

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line…

Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window…

In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service

In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data

In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data

HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling

The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that…

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J)

When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple…

curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the…

In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation

Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address

The MediaWiki "Report" extension has a Cross-Site Request Forgery (CSRF) vulnerability

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory…

curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content…