CVE-2022-21546

CVE-2022-21546 is a Linux kernel vulnerability affecting the SCSI target path. The issue arises in target_core_iblock/file when handling WRITE_SAME commands if the NDOB bit is set (NDOB indicates no data buffer) or when zero SG elements are sent. The kernel patch adds a common WRITE_SAME check fo...

admintwo 安全漏洞

admintwo is an application by xujiangfei individual developer. A security vulnerability exists in admintwo version 1.0, which originates from cross-site request forgery...

CVE-2024-4877

CVE-2024-4877 (OpenVPN) : A Windows vulnerability affecting OpenVPN 2.4.0–2.6.10 where an external, less-privileged process can create a named pipe that the OpenVPN GUI component connects to, enabling privilege escalation. The issue is specific to the Windows GUI interaction with the named pipe m...

CVE-2024-4877

OpenVPN version 2.4.0 through 2.6.10 on Windows allows an external, lesser privileged process to create a named pipe which the OpenVPN GUI component would connect to allowing it to escalate its privileges...

CVE-2019-16149

Fortinet CVE-2019-16149 affects FortiClient EMS 6.2.0, where improper neutralization of input during web page generation enables a remote attacker to execute unauthorized code by injecting a malicious payload into a FortiClient‑managed user profile. This is tied to FortiClient EMS web app data ha...

CVE-2022-1804

Summary: CVE-2022-1804 affects AccountsService. Local attackers could exploit a flaw where AccountsService incorrectly drops privileges when handling .pam_environment, potentially causing the service to crash or become unresponsive (denial of service). Affected components: AccountsService (Linux/...

CVE-2023-25610

Fortinet CVE-2023-25610 is a buffer underwrite in the FortiOS/FortiProxy administrative interface that allows remote, unauthenticated execution of code via crafted requests. Affected firmware ranges include FortiOS 7.2.0–7.2.3, 7.0.0–7.0.6, 6.4.0–6.4.11, 6.2.12 and below, FortiProxy 7.2.0–7.2.2, ...

CVE-2021-26091

CVE-2021-26091 concerns FortiMail Identity Based Encryption (IBE) authentication. The connected documents confirm a cryptographically weak PRNG used in the FortiMail authenticator, affecting FortiMail versions 6.4.0–6.4.4 and 6.2.0–6.2.7. The weakness may allow an unauthenticated attacker to infe...

CVE-2019-16151

Fortinet FortiOS 6.4.1 and below and FortiOS 6.2.9 and below are affected by an improper neutralization of input during web page generation (CWE-79). A remote unauthenticated attacker can exploit a crafted Host header to redirect users to malicious sites or to execute JavaScript in the victim’s b...

CVE-2021-25635

CVE-2021-25635 is a certificate-validation vulnerability in LibreOffice described as a Content Manipulation with Certificate Validation Attack. An attacker could enable self-signed ODF documents, then modify the signature algorithm to an invalid/unknown one; LibreOffice could display the signatur...

CVE-2021-25635

An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to self sign an ODF document, with a signature untrusted by the target, then modify it to change the signature algorithm to an invalid or unknown to LibreOffice algorithm and LibreOffice would incorrectly present...

CVE-2024-4990

CVE-2024-4990 (Yii2

LLaVA 资源管理错误漏洞

LLaVA is an application by Haotian Liu, an individual developer. A resource management error vulnerability exists in LLaVA v1.2.0, which stems from a file upload request being mishandled, which could lead to a denial of service...

CVE-2020-9295

CVE-2020-9295 affects Fortinet products where FortiOS 6.2 (AV engine <= 6.00142), FortiOS 6.4 (AV engine <= 6.00144), and FortiClient 6.2 (AV engine

Morning 安全漏洞

Morning is a public service online e-commerce store by the individual developer of Morning in China. A security vulnerability exists in Morning bc782730c74ff080494f145cc363a0b4f43f7d3e and prior versions, which stems from vulnerability to cross-site request forgery attacks...

CVE-2022-28693

CVE-2022-28693 is an information-disclosure vulnerability describing an unprotected alternative channel of return-branch target prediction on some Intel processors. The issue allows a locally authenticated user to potentially read sensitive memory. The primary context in the provided documents ti...

CVE-2022-31631

In PHP versions 8.0. before 8.0.27, 8.1. before 8.1.15, 8.2. before 8.2.2 when using PDO::quote function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to SQL injection vulnerabilities...

CVE-2022-31631

CVE-2022-31631 affects PHP versions where PDO::quote() on SQLite can misquote long input, enabling potential SQL injection. Affected: PHP 8.0.x before 8.0.27, 8.1.x before 8.1.15, and 8.2.x before 8.2.2. The issue stems from incorrect quoting in the SQLite path, as documented in multiple advisori...

CVE-2020-3432

Cisco AnyConnect Secure Mobility Client for Mac OS contains a local-file corruption vulnerability in its uninstaller component caused by improper handling of directory paths. An authenticated, local attacker can exploit this by creating a symbolic link to a target file on a specific path, potenti...

CVE-2022-3180

The CVE-2022-3180 issue affects the WordPress WPGateway plugin (versions up to and including 3.5). The root cause is an unauthenticated privilege-escalation flaw that lets an attacker insert a malicious administrator account, enabling full site control as described across multiple sources. Exploi...