All CVEs — page 409 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
This vulnerability allows heap-based buffer overflow, leading to potential arbitrary code execution when opening specially crafted session recording files.
A malicious remote peer can flood a QUIC stack with NEW_CONNECTION_ID frames, causing unbounded memory allocation through RETIRE_CONNECTION_ID frames that are queued in the Control Frame Queue. This leads to resource exhaustion and potential denial of service.
OpenSSL experiences a use-after-free vulnerability when multiple threads concurrently process the same X.509 certificate, causing freed memory to be accessed by other threads. This leads to crashes in TLS clients or servers handling concurrent connections with shared certificates.
The flaw lies in the DTLS retransmission logic, which can lead to heap memory disclosure or a Denial of Service (DoS) when handling suspended handshake message writes.
The flaw allows code execution via prompt injection with Jinja2 template syntax, leading to server-side expression evaluation without proper sanitization.
A TLS server using SSL_set_SSL_CTX() to switch contexts during handshake can access memory beyond array bounds when the new context knows about more provider signature algorithms than the original. This leads to potential out-of-bounds reads/writes and DoS.
The QUIC protocol implementation has a resource allocation flaw where packet buffers remain allocated for extended periods due to inefficient memory management. An attacker can force the system to keep excessive memory allocated by sending specially crafted packets, leading to potential denial of service through memory exhaustion.
The flaw in TeamViewer allows a local user with low privileges to perform arbitrary file writes with elevated privileges, leading to potential local privilege escalation.
Socket.IO's cluster-engine component had a prototype pollution vulnerability that allowed attackers to manipulate object properties during session ID lookups, leading to potential denial of service through Node.js process crashes. This affects clustered deployments where session IDs are used to identify connected clients.
This vulnerability allows context-dependent attackers to execute arbitrary operating system commands through a crafted serialized model directory, posing a high risk due to the potential for unauthorized command execution.