Vulnerabilities

There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and all samba 4.11.x versions before 4.11.5, essentially due to a call to realloc() while other local va…

All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level = 3" (or above) then the string obtained from the client, after a failed character c…

Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service.

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service.

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service.

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service.

Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service.

Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service.

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.

Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c.

Information exposure vulnerability in SYNO.Core.ACL in Synology DiskStation Manager (DSM) before 6.2-23739-2 allows remote authenticated users to determine the existence and obtain the metadata of arbitrary files via the…

A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected beh…

The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a zero-origin timestamp and source IP address of the "other side"…

ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a denial of service (disruption) by sending a packet with a zero-origin timestamp cau…

ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and mo…

Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.