CVE-2024-7441

Vivotek SD9364 httpd read stack-based overflow

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Vivotek SD9364 VVTK-0103f. It has been declared as critical. This vulnerability affects the function read of the component httpd. The manipulation of the argument Content-Length leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-273526 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the affected release tree is end-of-life.

CVSS 4.0 · 8.7 High EPSS 8.1% KEV · Not listed

Vendors

Vivotek

Products

Sd9364 Sd9364 Firmware

CVE-2024-7439

Vivotek CC8160 httpd read stack-based overflow

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Vivotek CC8160 VVTK-0100d and classified as critical. Affected by this issue is the function read of the component httpd. The manipulation of the argument Content-Length leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273524. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the affected release tree is end-of-life.

CVSS 4.0 · 8.7 High EPSS 1.0% KEV · Not listed

Vendors

Vivotek

Products

Cc8160 Cc8160 Firmware

CVE-2024-7331

TOTOLINK A3300R cstecgi.cgi UploadCustomModule buffer overflow

A vulnerability was found in TOTOLINK A3300R 17.0.0cu.557_B20221024 and classified as critical. Affected by this issue is the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument File leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-273254 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 8.7 High EPSS 1.2% KEV · Not listed

Vendors

Totolink

Products

A3300r A3300r Firmware

CVE-2022-27458

mariadb: use-after-poison in Binary_string::free_buffer

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-27447. Reason: This candidate is a reservation duplicate of CVE-2022-27447. Notes: All CVE users should reference CVE-2022-27447 instead of this candidate.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Software Collections

CVE-2024-26624

kernel: af_unix: fix lockdep positive in sk_diag_dump_icons()

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2021-46907

kernel: KVM: internal.ndata could be updated by the user process at anytime

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2023-4128

kernel: net/sched: Use-after-free vulnerabilities in the net/sched classifiers: cls_fw, cls_u32 and cls_route

** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-4206, CVE-2023-4207, CVE-2023-4208. Reason: This record is a duplicate of CVE-2023-4206, CVE-2023-4207, CVE-2023-4208. Notes: All CVE users should reference CVE-2023-4206, CVE-2023-4207, CVE-2023-4208 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.

CVSS 3.1 · 7.8 High EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Aus Rhel E4s and 4 more

CVE-2023-30079

libeconf: Stack overflow in function read_file at libeconf/lib/getfilecontents.c

DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-22652. Reason: This record is a duplicate of CVE-2023-22652. Notes: All CVE users should reference CVE-2023-22652 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.

CVSS 3.1 · 8.8 High EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Eus

CVE-2023-30078

libeconf: Stack overflow in function econf_writeFile at libeconf/lib/libeconf.c

DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-32181. Reason: This record is a duplicate of CVE-2023-32181. Notes: All CVE users should reference CVE-2023-32181 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.

CVSS 3.1 · 8.8 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2022-40156

xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks

DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Camel Quarkus Camel Spring Boot

CVE-2022-40155

xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks

DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Camel Quarkus

CVE-2022-40154

xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks

DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Camel Quarkus

CVE-2022-40153

xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks

DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Camel Quarkus

CVE-2022-3756

exiv2: integer overflow in quicktimevideo.cpp

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

CVSS 3.1 · 8.8 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2022-3719

exiv2: Heap-buffer-overflow in Exiv2::MemIo::read

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2022-3717

exiv2: multiple memory corruption in bmffimage.cpp

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2022-3522

kernel: race condition in hugetlb_no_page() in mm/hugetlb.c

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

CVSS 3.1 · 7.0 High EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Eus Rhev Hypervisor

CVE-2021-31291

exiv2: Heap-based buffer overflow vulnerability in jp2image.cpp

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-29457. Reason: This candidate is a duplicate of CVE-2021-29457. Notes: All CVE users should reference CVE-2021-29457 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

CVSS 3.1 · 8.1 High EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Eus

CVE-2021-20095

python-babel: Relative path traversal allows attacker to load arbitrary locale files and execute arbitrary code

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none

CVSS 3.1 · 7.8 High EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Software Collections

CVE-2020-26159

oniguruma: Buffer overflow in concat_opt_exact_str could result in DoS

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Further investigation showed that it was not a security issue. Notes: none

CVSS 3.1 · 8.6 High EPSS n/a KEV · Not listed

Vendors

—

Products

—