CVE-2024-53248

REJECT DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used...

CVE-2018-9369

CVE-2018-9369 describes a local elevation-of-privilege in the bootloader where a fastboot command allows a user to pass kernel command line arguments. The root cause is the bootloader’s handling of user-supplied kernel parameters, enabling a local attacker to gain higher privileges without additi...

CVE-2021-1424

CVE-2021-1424 concerns Cisco ASR 5000 Series Software (StarOS) where the ipsecmgr process is vulnerable to unauthenticated, remote DoS via specially malformed IKEv2 packets. The issue stems from insufficient validation of incoming IKEv2 traffic, and exploitation can cause the ipsecmgr process to ...

CVE-2017-13313

CVE-2017-13313 affects the Android Media framework (ESQueue.cpp, ElementaryStreamQueue::dequeueAccessUnitMPEG4Video). The issue is an infinite loop caused by an incorrect bounds check, leading to remote denial of service with no additional privileges required. Availability impact is DoS; exploita...

CVE-2017-13314

CVE-2017-13314 affects Android by with a missing permission check in NetworkManagementService.setAllowOnlyVpnForUids, enabling local escalation of privilege to access non-VPN networks when VPN-only access is intended. The issue is described as a security settings bypass in NetworkManagementServic...

CVE-2017-13311

The provided connected documents confirm CVE-2017-13311 affects the Android Framework, specifically the read() function in ProcessStats.java, causing a read/write serialization issue that enables a permissions bypass. This can lead to local escalation of privilege, allowing an app to start an act...

CVE-2021-1483

Cisco SD-WAN vManage Software contains an XXE handling flaw in its web UI that could allow an authenticated remote attacker to read and write files within the affected application by convincing a user to import a crafted XML file. The issue stems from improper XML External Entity processing durin...

CVE-2022-20634

Cisco Enterprise Chat and Email (ECE) Web-based management interface vulnerability (CVE-2022-20634) allows an unauthenticated, remote attacker to cause user redirection to a malicious URL via crafted links. Root cause: improper input validation of URL parameters in HTTP requests. Affects Cisco EC...

CVE-2022-20849

CVE-2022-20849 affects Cisco IOS XR Software PPPoE functionality. An unauthenticated, adjacent attacker can send a crafted PPPoE packet sequence that the PPPoE feature does not handle correctly, causing the PPPoE process to repeatedly crash and restart, resulting in denial of service. The issue i...

CVE-2022-20931

CVE-2022-20931 concerns Cisco TelePresence CE Software used on Cisco Touch 10 devices, where weak version control allows an unauthenticated, adjacent attacker to downgrade to an older software version. The root cause is insufficient version control in the software update flow, enabling installati...

CVE-2022-20853

CVE-2022-20853 concerns Cisco Expressway Series and Cisco TelePresence VCS. The issue is a CSRF vulnerability in the REST API/web-based management interface caused by insufficient CSRF protections, allowing an unauthenticated, remote attacker to persuade a logged-in user to follow a crafted link,...

CVE-2021-3838

CVE-2021-3838 affects php-dompdf (before 2.0.0). The flaw stems from PHAR deserialization due to insufficient protocol checking when passing input to file_get_contents(), allowing an attacker who can upload arbitrary files to trigger deserialization via phar:// and potentially achieve remote code...

PT-2024-37606 · Undefined · Undefined

CVE-2024-6413 Duplicate CVE Reserved Reference CVE-2023-2414 Instead: This candidate number is rejected and should not be used. It is a duplicate of CVE-2023-2414. All information and references in this candidate... https://t.co/wnIMr6LEKZ...

CVE-2017-13227

The CVE-2017-13227 issue affects the Android Autofill framework specifically stating that the package name provided by the app process is trusted inappropriately, leading to potential information disclosure with no additional privileges required. The description indicates a local attack vector wi...

CVE-2024-3447

CVE-2024-3447 — QEMU SDHCI heap-based buffer overflow A heap overflow in the SDHCI device emulation of QEMU is triggered when both s->data_count and the size of s->fifo_buffer are 0x200, causing an out-of-bounds access. A malicious guest could crash the QEMU process on the host, resulting i...

CVE-2022-31667

Harbor (the Harbor registry) is affected by CVE-2022-31667 due to improper authorization when updating a robot account. The issue occurs when a request to update a robot account specifies an account and name belonging to a project the authenticated user cannot access, allowing an attacker to revo...

CVE-2022-31671

Harbor (open source registry) contains an authorization issue in the P2P preheat execution logs: authenticated users could read all job logs by requesting different job IDs, indicating a permissions validation failure when reading/updating logs. The CVE entry is corroborated by multiple feeds (GH...

CVE-2022-31666

Harbor vulnerability CVE-2022-31666 involves failure to validate user permissions when managing Webhook policies. The issue allows authenticated users to view, update, or delete Webhook policies belonging to other users or projects, potentially enabling modification of policies configured in othe...

CVE-2020-10370

CVE-2020-10370 affects Cypress (and Broadcom) Wireless Combo chips, specifically the CYW43455. When the 2021-01-26 Bluetooth firmware update is not present, a Bluetooth outage is possible via a Spectra attack. The provided documents do not include explicit vulnerability details beyond this descri...

CVE-2023-1973

CVE-2023-1973 is an Undertow vulnerability that allows a remote attacker to cause a Denial of Service by exploiting FormAuthenticationMechanism, leading to OutOfMemory on the server. The connected records (e.g., Red Hat RHSA-2025-9583) confirm this issue and indicate remediation via security upda...