CVE Vulnerability Catalog

Vulnerability in in.rlogind in SunOS 4.0.3 and 4.0.3c allows local users to gain root privileges.

Vulnerability in /bin/mail in SunOS 4.1.1 and earlier allows local users to gain root privileges via certain command line arguments.

Vulnerability in the /etc/suid_exec program in HP Apollo Domain/OS sr10.2 and sr10.3 beta, related to the Korn Shell (ksh).

TIOCCONS in SunOS 4.1.1 does not properly check the permissions of a user who tries to redirect console output and input, which could allow a local user to gain privileges.

The BuildDisk program on NeXT systems before version 2.0 does not prompt users for the root password, allowing local users to gain root privileges.

Vulnerability in NeXT 1.0a and 1.0 allows local users to gain privileges via a combination of the npd program and weak directory permissions.

Vulnerability in the restore0.9 installation script in NeXT 1.0a and 1.0 allows local users to gain root privileges.

Buffer overflow in FreeBSD libmytinfo library allows local users to execute commands via a long TERMCAP environmental variable.

Certain NFS servers allow users to use mknod to gain privileges by creating a writable kmem device and setting the UID to 0.

Vulnerability in SMI Sendmail 4.0 and earlier, on SunOS up to 4.0.3, allows remote attackers to access user bin.

Vulnerability in rcp on SunOS 4.0.x allows remote attackers from trusted hosts to execute arbitrary commands as root, possibly related to the configuration of the nobody user.

Buffer overflow in passwd in BSD based operating systems 4.3 and earlier allows local users to gain root privileges by specifying a long shell or GECOS field.

The CWD ~root command in the ftpd server allows root access to the system.

The debug command in Sendmail is enabled, allowing attackers to execute commands as root.

In Pillow's libtiff encoder (PyImaging_LibTiffEncoderNew in src/encode.c), crafted TIFF tags can cause memory disclosure and a segfault. The issue occurs when creating the LibTiff encoder.

This is a residual of GHSA-g5vv-9gxw-82hx / CVE-2026-87819. The 3.1.60 fix made Actor._from_string regex-free, but parse_actor_and_date still runs _re_actor_epoch on the same author/committer/tagger line one step earlier. That pattern backtracks quadratically when the trailing epo...

GitPython spent 2022-2026 rolling out two reusable guards method-by-method: Git.check_unsafe_protocols(url) (raises UnsafeProtocolError for <transport>:: remote-helper URLs) and Git.check_unsafe_options(...) (raises UnsafeOptionError for denylisted options). The description indicates the rollout did not cover all code paths.

Multiple cases were found in aiohttp where excessive or unbounded memory use, or excessive CPU consumption, can be triggered by attacker-controlled requests. An attacker could cause resource exhaustion through specially crafted requests.

A vulnerability in the Crass library involves unbounded exponentiation when converting CSS scientific notation number values before clamping the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS strings can be forced to consume excessive CPU and memory when processing a tiny input.

GitPython's config-name validator only neutralizes CR/LF/NUL for the "option" label; it does not reject =, #, ;, [, ], or whitespace in an option name. write_section writes the option name verbatim into the config file, so an option name such as sshCommand = touch <cmd> can inject configuration.