CVE-2020-13434Published
SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.
cve-program ·
Vendor product: n/a
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
695690 source statements · aliases may refer to the same vulnerabilityCVE-2020-12762Published
json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend.
cve-program ·
Vendor product: n/a
CVE-2020-12723Published
regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.
cve-program ·
Vendor product: n/a
CVE-2020-12243Published
In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).
cve-program ·
Vendor product: n/a
CVE-2020-10735Published
A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.fr…
cve-program ·
Vendor product: python
CVE-2020-12811Published
A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable
cve-program ·
Vendor product: FortiManager · Vendor product: FortiAnalyzer
CVE-2020-10543Published
Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.
cve-program ·
Vendor product: n/a
CVE-2020-8286Published
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.
cve-program ·
Vendor product: https://github.com/curl/curl
CVE-2020-8285Published
curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.
cve-program ·
Vendor product: https://github.com/curl/curl
CVE-2020-8284Published
A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not …
cve-program ·
Vendor product: https://github.com/curl/curl
CVE-2020-8177Published
curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.
cve-program ·
Vendor product: https://github.com/curl/curl
CVE-2020-7595Published
xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.
cve-program ·
Vendor product: n/a
CVE-2020-6096Published
An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter r…
cve-program ·
Vendor product: GNU glibc
CVE-2020-1712Published
A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or p…
cve-program ·
Vendor product: systemd
CVE-2019-1010180Published
GNU gdb All versions is affected by: Buffer Overflow - Out of bound memory access. The impact is: Deny of Service, Memory Disclosure, and Possible Code Execution. The component is: The main gdb module. The attack vector is: Open an ELF for …
cve-program ·
Vendor product: gdb
CVE-2019-1010024Published
GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no …
cve-program ·
Vendor product: glibc
CVE-2019-1010023Published
GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim a…
cve-program ·
Vendor product: glibc
CVE-2019-1010022Published
GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to by…
cve-program ·
Vendor product: glibc
CVE-2019-20388Published
xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
cve-program ·
Vendor product: n/a
CVE-2019-20367Published
nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab).
cve-program ·
Vendor product: n/a
CVE-2019-20218Published
selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error.
cve-program ·
Vendor product: n/a
CVE-2019-19956Published
xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.
cve-program ·
Vendor product: n/a
CVE-2019-19925Published
zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive.
cve-program ·
Vendor product: n/a
CVE-2019-19646Published
pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns.
cve-program ·
Vendor product: n/a
CVE-2019-19603Published
SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash.
cve-program ·
Vendor product: n/a
CVE-2019-19244Published
sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage.
cve-program ·
Vendor product: n/a
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.