CVE-2021-3928Published
Use of Uninitialized Variable in vim/vim
cve-program ·
Vendor product: vim/vim
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698000 source statements · aliases may refer to the same vulnerabilityCVE-2022-1616Published
Use after free in append_command in vim/vim
cve-program ·
Vendor product: vim/vim
CVE-2022-1674Published
NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 in vim/vim
cve-program ·
Vendor product: vim/vim
CVE-2022-1620Published
NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in vim/vim
cve-program ·
Vendor product: vim/vim
CVE-2023-22490Published
Git vulnerable to local clone-based data exfiltration with non-local transports
cve-program ·
Vendor product: git
CVE-2017-5645Published
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary…
cve-program ·
Vendor product: Apache Log4j
CVE-2020-11987Published
Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server t…
cve-program ·
Vendor product: Apache Batik
CVE-2022-1619Published
Heap-based Buffer Overflow in function cmdline_erase_chars in vim/vim
cve-program ·
Vendor product: vim/vim
CVE-2018-7166Published
In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This method is intended to be safe and only return initialized, or cleared, memory. The third argument spe…
cve-program ·
Vendor product: Node.js
CVE-2018-7164Published
Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. An …
cve-program ·
Vendor product: Node.js
CVE-2018-7158Published
The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced in Node.js 6.x and later so this vulnerability only impacts all versions of Node…
cve-program ·
Vendor product: Node.js
CVE-2017-8529Published
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, and Windows Server 2012 and R2 allow an attacker to detect specific files on the user's computer when affected Microsoft scripting eng…
cve-program ·
Vendor product: Internet Explorer
CVE-2018-7160Published
The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another …
cve-program ·
Vendor product: Node.js
CVE-2018-7167Published
Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were updated so that …
cve-program ·
Vendor product: Node.js
CVE-2018-7162Published
All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node process which provides an http server supporting TLS server to crash. This can be accomplished b…
cve-program ·
Vendor product: Node.js
CVE-2018-7161Published
All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server providing an http2 server to crash. This can be accomplished by interacting with th…
cve-program ·
Vendor product: Node.js
CVE-2022-27545Published
HCL BigFix Web Reports authorized users may perform HTML injection.
cve-program ·
Vendor product: HCL BigFix
CVE-2022-27544Published
HCL BigFix Web Reports authorized users may see sensitive information in clear text
cve-program ·
Vendor product: HCL BigFix
CVE-2019-3740Published
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recove…
cve-program ·
Vendor product: RSA BSAFE Crypto-J
CVE-2020-12322Published
Improper input validation in some Intel(R) Wireless Bluetooth(R) products before version 21.110 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
cve-program ·
Vendor product: Intel(R) Wireless Bluetooth(R)
CVE-2023-20178Published
A vulnerability in the client update process of Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco Secure Client Software for Windows could allow a low-privileged, authenticated, local attacker to elevate privileges to t…
cve-program ·
Vendor product: Cisco Secure Client
CVE-2021-33656Published
When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds.
cve-program ·
Vendor product: openEuler:kernel
CVE-2020-12321Published
Improper buffer restriction in some Intel(R) Wireless Bluetooth(R) products before version 21.110 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
cve-program ·
Vendor product: Intel(R) Wireless Bluetooth(R)
CVE-2021-21295Published
Possible request smuggling in HTTP/2 due missing validation
cve-program ·
Vendor product: io.netty:netty-codec-http2
CVE-2022-25762Published
Response mix-up with WebSocket concurrent send and close
cve-program ·
Vendor product: Apache Tomcat
CVE-2023-26119Published
Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage.
cve-program ·
Vendor product: net.sourceforge.htmlunit:htmlunit
CVE-2023-35636Published
Microsoft Outlook Information Disclosure Vulnerability
cve-program ·
Vendor product: Microsoft Office 2019 · Vendor product: Microsoft 365 Apps for Enterprise · Vendor product: Microsoft Office LTSC 2021
CVE-2021-21290Published
Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files
cve-program ·
Vendor product: netty
CVE-2018-12120Published
Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with `node --debug` or `node debug`, it listens to port 5858 on all interfaces by default. This may allow re…
cve-program ·
Vendor product: Node.js
CVE-2018-12123Published
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed by…
cve-program ·
Vendor product: Node.js
CVE-2018-12116Published
Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigg…
cve-program ·
Vendor product: Node.js
CVE-2018-12122Published
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connections and associated res…
cve-program ·
Vendor product: Node.js
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.