CVE-2022-26758

CVE-2022-26758: macOS Monterey before 12.4 is affected by a memory corruption issue that may allow a malicious application to cause unexpected changes in memory shared between processes. The vulnerability is addressed in macOS Monterey 12.4 with improved state management. The CVE entry notes a lo...

CVE-2024-32537

CVE-2024-32537 is a CSRF vulnerability in the Flash Video Player plugin for WordPress (joshuae1974). Public description indicates the issue affects Flash Video Player versions from unspecified earliest through 5.0.4. Connected sources confirm a CSRF flaw; Red Hat and CVE feeds reiterate the same,...

CVE-2024-4025

CVE-2024-4025 describes a DoS in GitLab CE/EE across all versions up to fixed points: 7.10–16.11.4, 17.0 prior to 17.0.3, and 17.1 prior to 17.1.1, triggered by processing a crafted Markdown page. The issue's impact is high (availability loss) per CVSS; no exploitation details are provided in the...

CVE-2022-1804

Summary: CVE-2022-1804 affects AccountsService. Local attackers could exploit a flaw where AccountsService incorrectly drops privileges when handling .pam_environment, potentially causing the service to crash or become unresponsive (denial of service). Affected components: AccountsService (Linux/...

CVE-2023-28120

CVE-2023-28120 affects ActiveSupport: invoking the new bytesplice method on a SafeBuffer with untrusted input can lead to cross-site scripting (CWE-79). Connected sources confirm the vulnerability exists, but the provided documents do not specify affected versions or a fixed patch version. There ...

CVE-2021-26093

CVE-2021-26093 corresponds to an uninitialized pointer (CWE-824) vulnerability in Fortinet FortiWLC. According to the sources, FortiWLC versions 8.6.0, 8.5.3 and earlier are affected, and a local, authenticated attacker can crash the access point being managed by the controller by issuing a craft...

CVE-2018-9431

CVE-2018-9431 : The connected documents confirm a local elevation of privilege due to improper input validation in OSUInfo.java (OSUInfo component). The impact is described as local Privilege Escalation without user interaction. No exploit pathways, affected product versions, or fix/patch details...

CVE-2018-9349

CVE-2018-9349 describes an out-of-bounds read in the mv_err_cost function of mcomp.c, leading to denial of service with no additional privileges. Exploitation requires user interaction. The available documents do not specify affected products/versions or a patched release; no concrete remediation...

CVE-2017-13323

CVE-2017-13323 is a Google/Android elevation-of-privilege flaw caused by an out-of-bounds write in String16.cpp due to an integer overflow. The Red Hat and CNVD entries restate the issue; Android/Pixel bulletin notes this CVE as EoP (Moderate) and indicates patches are included in the 2018-05-05 ...

CVE-2016-10408

CVE-2016-10408 affects Qualcomm QSEE. Red Hat and NVD entries describe a vulnerability where QSEE may randomly experience a fatal error during execution due to speculative instruction fetches from device memory (memory region not valid executable memory). This is a local issue with a high impact ...

CVE-2018-9475

The CVE-2018-9475 issue affects Android’s Bluetooth stack (HeadsetInterface::ClccResponse in btif_hf.cc), causing an out-of-bounds stack write that could enable remote elevation of privilege via Bluetooth when SIP calls are enabled, with no user interaction required. Exploitation details are not ...

CVE-2018-9466

CVE-2018-9466 : A vulnerability in libxml2’s valid.c xmlSnprintfElementContent can cause an out-of-bounds write, enabling remote escalation of privilege in an unprivileged process with user interaction required. Public details across sources confirm the issue’s presence in libxml2 and describe th...

CVE-2021-1482

CVE-2021-1482 concerns Cisco SD-WAN vManage Software, where the web-based management interface contains insufficient authorization checks. An authenticated, remote attacker could send crafted HTTP requests to bypass authorization and access sensitive information on the affected system. The CVSS 3...

CVE-2021-1494

CVE-2021-1494 affects the Snort detection engine used by multiple Cisco products. The vulnerability arises from incorrect handling of specific HTTP header parameters, allowing an unauthenticated remote attacker to bypass a configured file policy for HTTP packets and deliver a malicious payload. I...

CVE-2022-20632

Cisco Enterprise Chat and Email (ECE) web-based management interface vulnerability (CVE-2022-20632) allows an unauthenticated, remote attacker to perform a reflected XSS by enticing a user to click a crafted link. The issue arises from inadequate validation of user-supplied input in the interface...

CVE-2022-20654

CVE-2022-20654 affects Cisco Webex Meetings: an unauthenticated remote attacker can exploit insufficient input validation in the web-based interface to trigger cross-site scripting (XSS) by enticing a user to click a crafted link. Impact per sources includes execution of arbitrary script code in ...

CVE-2022-20652

Cisco Tetration contains a command-injection vulnerability in the web-based management interface and API subsystem. An authenticated remote attacker with administrator credentials can submit crafted HTTP messages to execute commands with root privileges due to insufficient input validation. Impac...

CVE-2023-32191

The CVE-2023-32191 issue affects Rancher RKE: cluster state is stored in the full-cluster-state configmap in the kube-system namespace, containing sensitive credentials and keys (e.g., SSH keys, cloud provider credentials, encryption keys). This enables non-admin users to escalate to admin. Patch...

CVE-2024-5148

The CVE-2024-5148 issue affects the gnome-remote-desktop package. The gnome-remote-desktop system daemon inadequately validates session-handover via D-Bus during the login screen-to-user session transition, allowing a malicious local user to take control of the RDP client connection and potential...

CVE-2023-47769

CVE-2023-47769 affects WordPress WP Maintenance up to version 6.1.3. It describes an IP-filtering bypass that enables authentication bypass and access to constrained functionality. The CVSS v3.1 base score is 3.7 (Low); vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. Patchstack indicates th...