Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Critical9.8xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.Feb 16, 2022
- High7.5Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.Jan 26, 2022
- High7.0Linux Kernel Privilege Escalation VulnerabilityKEVEPSS 6.6%Jan 26, 2022
- Critical9.8Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.Jan 24, 2022
- Critical9.8The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without…Jan 14, 2022
- Critical9.8The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without v…Jan 14, 2022
- Medium5.3Zabbix Frontend Improper Access Control VulnerabilityKEVEPSS 95.3%Jan 13, 2022
- High8.8storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.Jan 10, 2022
- High8.8nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.Jan 10, 2022
- High8.8lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.Jan 10, 2022
- Critical9.8defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.Jan 10, 2022
- Critical9.8build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.Jan 10, 2022
- Critical9.8addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.Jan 10, 2022
- High8.8In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too…Jan 1, 2022
- Medium6.4Android Kernel Race Condition VulnerabilityKEVEPSS 0.9%Dec 15, 2021
- Critical9.0Apache Log4j2 Deserialization of Untrusted Data VulnerabilityKEVEPSS 100.0%Dec 14, 2021
- Critical10.0Apache Log4j2 Remote Code Execution VulnerabilityKEVEPSS 100.0%Dec 10, 2021
- Critical9.8Roundcube Webmail SQL Injection VulnerabilityKEVEPSS 69.9%Nov 18, 2021
- High7.5GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segme…Nov 15, 2021
- High8.8Google Chromium V8 Memory Corruption VulnerabilityKEVEPSS 38.6%Nov 3, 2021
- Medium6.1Google Chromium Intents Improper Input Validation VulnerabilityKEVEPSS 4.9%Nov 3, 2021
- Medium6.5Google Chromium Information Disclosure VulnerabilityKEVEPSS 19.9%Oct 8, 2021
- High8.8Google Chromium V8 Use-After-Free VulnerabilityKEVEPSS 34.9%Oct 8, 2021
- Critical9.6Google Chromium Portals Use-After-Free VulnerabilityKEVEPSS 11.7%Oct 8, 2021
- Medium5.9When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back m…Sep 29, 2021