CVE Vulnerability Catalog

The pip package before version 19.2 for Python is vulnerable to directory traversal when a URL is provided in an install command. An attacker can exploit a Content-Disposition header containing '../' in the filename to overwrite files, such as /root/.ssh/authorized_keys.

A NULL pointer dereference vulnerability was found in the Linux kernel's ALSA driver for the TASCAM US-144MKII device. A malicious USB device can have a configuration with interface number 1 but missing interface 0, leading to a system crash.

In the Linux kernel, a vulnerability in KVM for AMD SEV-SNP was found. During SNP launch finish, the synchronization and encryption of VMSA (Virtual Machine Save Area) does not lock all vCPUs, allowing userspace to manipulate or run a vCPU while its state is being synchronized.

An issue was discovered in py-lmdb 0.97 where for certain values of mn_flags, mdb_cursor_set triggers a memcpy with an invalid write operation within mdb_xcursor_init1. This occurs when accessing a data.mdb file supplied by an attacker.

SQLite3 from version 3.6.0 to 3.27.2 inclusive is vulnerable to a heap out-of-bounds read in the rtreenode() function when handling invalid rtree tables.

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv utility of uutils coreutils during cross-device moves. The extended attribute (xattr) preservation logic uses multiple path-based system calls that perform fresh path-to-inode lookups for each operation. A local attacker with write access can exploit this race condition.

CPAN.pm before version 2.35 does not verify TLS certificates when downloading distributions over HTTPS. This allows man-in-the-middle attackers to replace downloaded packages with malicious ones.

A vulnerability in systemd causes systemd-coredump to ignore the kernel's fs.suid_dumpable setting, potentially leading to a local information leak.

The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. It falls back to a copy-and-delete routine that creates the destination file using the caller's UID/GID instead of the source's metadata.

An improper access control vulnerability in AMD SEV-SNP allows an admin privileged attacker to write to the RMP during SNP initialization, potentially leading to loss of SEV-SNP guest memory integrity.

The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve) flag, the utility applies the source mode bits even if the chown operation is unsuccessful. This can result in a user-owned copy retaining original setuid/setgid bits.

The sort utility in uutils coreutils crashes (panics) when using the --files0-from option with inputs containing non-UTF-8 filenames. The implementation enforces UTF-8 encoding and uses expect(), causing an immediate crash upon encountering valid but non-UTF-8 paths.

A vulnerability in the tail utility of uutils coreutils allows exfiltration of sensitive file contents when using the --follow=name option. Unlike GNU tail, the uutils implementation continues to monitor a path after it has been replaced by a symbolic link, subsequently outputting its contents.

The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While intended to mimic GNU behavior for special files like /dev/null, the uutils implementation also hides failures on regular files and directories.

In NTFS-3G through version 2026.2.25, a heap buffer overflow in ntfs_decompress() in compress.c allows an attacker to corrupt one byte of heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image and reading a specially crafted file.

An improper access control vulnerability in AMD Secure Encrypted Virtualization (SEV) firmware allows a malicious hypervisor to bypass RMP protections, potentially compromising SEV-SNP guest memory integrity.

The vulnerability in python-cryptography 3.2 allows Bleichenbacher timing attacks on the RSA decryption API. Attackers can exploit timing differences in processing valid PKCS#1 v1.5 ciphertext.

A vulnerability in CPython (from version 0 to 3.6.13, 3.7.0-3.7.10, 3.8.0-3.8.8, 3.9.0-3.9.2) allows Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs functions. An attacker can use a technique called 'parameter cloaking' to manipulate query parameters.

An issue was discovered in py-lmdb 0.97 where mdb_page_touch does not properly set up mc->mc_pg[mc->top] for certain mp_flags values, leading to an invalid write operation. The vulnerability can be triggered by supplying a crafted data.mdb file.

A vulnerability in SEV (Secure Encrypted Virtualization) firmware causes insufficient or incomplete data removal in a hardware component, resulting in incomplete IOMMU flushing. This can potentially lead to a loss of confidentiality and integrity in guest memory.