SUSE CVE-2026-91958

FreeRDP versions before 3.31.0 fail to validate MonitorIds array values when parsing RDP connection files, allowing unbounded array indexing in xfdetectmonitors. Attackers can craft a malicious RDP file with an out-of-range selectedmonitors value to trigger out-of-bounds heap read and write...

FreeRDP: FreeRDP: Double-free vulnerability via crafted .rdp file leading to potential remote code execution

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. A double-free vulnerability exists when a FreeRDP client processes a specially crafted .rdp connection file. An attacker could convince a victim to open a malicious .rdp file, leading to a size-controlled...

PT-2026-61581

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.x through 3.27.1 Description A double-free issue exists in the freerdp client rdp file apply to settings function located in client/common/file.c when parsing the selectedmonitors field of a .rdp connection file. The...

CVE-2026-42471

Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The sync-invoke client Connection.php:76 calls unserialize on data received from the server response, enabling client-side RCE if connecting to a malicious server...

PHP code mixing issue vulnerabilities

Mix PHP is Mix PHP open source a PHP command line mode development framework that supports seamless multi-server ecosystem switching. A code issue vulnerability exists in Mix PHP versions 2.x through 2.2.17, which stems from a call to unserialize in Connection.php to process server response data,...

EUVD-2016-0793

Malware in sbrugna...

AndSoft e-TMS SQL injection vulnerability

AndSoft e-TMS is a logistics management software from AndSoft Spain. AndSoft e-TMS suffers from an SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the SessionID cookie parameter in file /inc/connect/CONNECTION.ASP. An attacker can us...

CVE-2025-3268

A vulnerability has been found in qinguoyi TinyWebServer up to 1.0 and classified as critical. This vulnerability affects unknown code of the file http/httpconn.cpp. The manipulation of the argument murlreal leads to improper authentication. The attack can be initiated remotely. The exploit has...

PT-2025-15042 · Unknown · Qinguoyi Tinywebserver

Name of the Vulnerable Software and Affected Versions: qinguoyi TinyWebServer version 1.0 Description: A critical issue has been found in the software, affecting some unknown functionality of the file /http/http conn.cpp. The manipulation of the name and password arguments leads to a stack-based...

CVE-2025-27103

Summary (CVE-2025-27103) DataEase (open source BI tool) prior to v2.10.6 is affected by a bypass of the patch for CVE-2024-55953 that allows authenticated users to read and deserialize arbitrary files via the background JDBC connection. The issue arises from the unfiltered JDBC connection string ...

CVE-2024-55953

DataEase is an open-source business analytics tool. CVE-2024-55953 affects the JDBC credential/connection handling: authenticated users can read and deserialize arbitrary files via the background JDBC connection because connection-string parameters are not filtered. Root cause: unfiltered paramet...

SUSE CVE-2014-3637

D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 does not properly close connections for processes that have terminated, which allows local users to cause a denial of service via a D-bus message containing a D-Bus connection file descriptor...

CVE-2021-25230

An improper access control vulnerability in Trend Micro Apex One on-prem and SaaS and OfficeScan XG SP1 could allow an unauthenticated user to obtain information about the contents of a scan connection exception file...

PT-2019-18157 · Aveva · Intouch Edge Hmi +1

Name of the Vulnerable Software and Affected Versions: AVEVA Software, LLC InduSoft Web Studio versions prior to 8.1 SP3 AVEVA Software, LLC InTouch Edge HMI formerly InTouch Machine Edition versions prior to 2017 Update Description: An issue exists where an unauthenticated remote user could...

CVE-2016-0778

The 1 roamingread and 2 roamingwrite functions in roamingcommon.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly maintain connection file descriptors, which allows remote servers to cause a denial of service heap-based...

Heap overflow

The 1 roamingread and 2 roamingwrite functions in roamingcommon.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly maintain connection file descriptors, which allows remote servers to cause a denial of service heap-based...

Design/Logic Flaw

D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 does not properly close connections for processes that have terminated, which allows local users to cause a denial of service via a D-bus message containing a D-Bus connection file descriptor...

CVE-2014-3637

D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 does not properly close connections for processes that have terminated, which allows local users to cause a denial of service via a D-bus message containing a D-Bus connection file descriptor...

CVE-2014-3637: Undefined Security Weakness

D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 does not properly close connections for processes that have terminated, which allows local users to cause a denial of service via a D-bus message containing a D-Bus connection file descriptor...

PT-2014-1926

Name of the Vulnerable Software and Affected Versions D-Bus versions 1.3.0 through 1.6.x before 1.6.24 D-Bus versions 1.8.x before 1.8.8 Description The issue allows local users to cause a denial of service via a D-bus message containing a D-Bus connection file descriptor, as connections for...