CVE-2021-26102

CVE-2021-26102 describes a relative path traversal (CWE-23) in FortiWAN. FortiWAN versions 4.5.7 and earlier (including all 4.4.x) may allow a remote, unauthenticated attacker to delete files on the system by sending a crafted POST request. In particular, deletion of specific configuration files ...

CVE-2021-32589

CVE-2021-32589 describes a remote, unauthenticated Use-After-Free in the fgfmsd daemon of Fortinet FortiManager and FortiAnalyzer. The flaw in the fgfm port handling (memory after free) allows a non-authenticated attacker to execute arbitrary code with root privileges by sending a crafted request...

CVE-2020-15934

CVE-2020-15934 describes a local privilege-escalation in FortiClient for Linux (VCM engine) affecting 6.2.7 and earlier and 6.4.0, where a local user could create a malicious script/program to elevate to root. Exploitation details are not provided in the documents, but mitigations from PT-2020-70...

CVE-2020-12820

Affected software: FortiOS 6.0.10 and below and 5.6.12 and below, with the issue in the FortiClient NAC daemon (fcnacd). Root cause: stack-based buffer overflow under non-default configurations could be triggered by a large FortiClient file name, when an attacker is authenticated to the SSL VPN. ...

CVE-2021-26093

CVE-2021-26093 corresponds to an uninitialized pointer (CWE-824) vulnerability in Fortinet FortiWLC. According to the sources, FortiWLC versions 8.6.0, 8.5.3 and earlier are affected, and a local, authenticated attacker can crash the access point being managed by the controller by issuing a craft...

CVE-2024-35141

CVE-2024-35141 affects IBM Security Verify Access Docker 10.0.0–10.0.6. Root cause: execution of unnecessary privileges enables local privilege escalation. Impact: local attacker could escalate privileges (high). IBM bulletins indicate fixes in 10.0.7/FP0 or later; remediation is to upgrade to th...

CVE-2021-39081

IBM Cognos Analytics Mobile for Android 1.1.14 is affected by CVE-2021-39081, due to weaker cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. The issue impact is limited to the Android app and could affect confidentiality (C: High) with no integrity/av...

CVE-2021-20553

CVE-2021-20553 affects IBM Sterling B2B Integrator Standard Edition (versions 5.2.0.0 through 6.1.1.0). The issue is a cross-site scripting vulnerability in the Web UI that lets an attacker embed arbitrary JavaScript, potentially altering functionality and disclosing credentials within a trusted ...

CVE-2023-21586

CVE-2023-21586 — Adobe Acrobat Reader : NULL pointer dereference vulnerability affecting versions 22.003.20282 and earlier, 22.003.20281 and earlier, and 20.005.30418 and earlier. An unauthenticated attacker could cause an application denial-of-service, with exploit requiring user interaction (vi...

CVE-2022-44518

CVE-2022-44518 affects Adobe Acrobat Reader DC (and earlier/Classic variants) with a use-after-free vulnerability that could lead to arbitrary code execution in the current user context. The issue requires user interaction: a victim must open a malicious file. Public details list affected product...

CVE-2022-44519

CVE-2022-44519 affects Acrobat Reader DC (versions 22.001.20085 and earlier, 20.005.3031x and earlier, 17.012.30205 and earlier). Root cause: a use-after-free in a component used when opening a malicious file, leading to possible disclosure of sensitive memory and the ability to bypass ASLR. Expl...

CVE-2022-44512

Adobe Acrobat Reader DC is affected by out-of-bounds write (CWE-787) in parsing that could lead to arbitrary code execution in the current user context. Affected versions include 22.001.20085 and earlier, 20.005.3031x and earlier, and 17.012.30205 and earlier. Exploitation requires user interacti...

CVE-2022-44516

CVE-2022-44516 is an out-of-bounds read in Acrobat Reader DC when parsing a crafted file, potentially bypassing ASLR. Affected: Acrobat Reader DC 22.001.20085 and earlier; 20.005.3031x and earlier; 17.012.30205 and earlier. Exploitation requires user interaction (the victim must open a malicious ...

CVE-2022-44513

CVE-2022-44513 affects Adobe Acrobat Reader DC (versions including 22.001.20085 and earlier; 20.005.3031x and earlier; 17.012.30205 and earlier). The vulnerability is an out-of-bounds write in the processing of certain files that could lead to arbitrary code execution in the context of the curren...

CVE-2022-44515

CVE-2022-44515 affects Adobe Acrobat Reader DC (versions 22.001.20085 and earlier; 20.005.3031x and earlier; 17.012.30205 and earlier). The vulnerability is an out-of-bounds read when parsing a crafted file, allowing read past the end of an allocated memory structure and potentially bypassing mit...

CVE-2023-44149

CVE-2023-44149 affects the WordPress plugin Brands for WooCommerce (versions

CVE-2023-41951

CVE-2023-41951 affects rtMedia for WordPress, BuddyPress and bbPress (vulnerable from n/a up to and including 4.6.14). It is a Missing Authorization/Broken Access Control vulnerability allowing exploitation via incorrectly configured access levels. Patch 4.6.15 fixes the issue; base CVSS v3.1 sco...

CVE-2023-41870

CVE-2023-41870 affects the WP Crowdfunding plugin by Themeum (WordPress) up to version 2.1.5. The issue is a Missing Authorization/Improper Access Control vulnerability caused by incorrectly configured access control security levels, enabling unauthorized access to restricted areas. Red Hat and P...

CVE-2023-41869

CVE-2023-41869 affects the WordPress plugin WP Accessibility Helper (WAH) up to version 0.6.2.4. The issue is a Missing Authorization via AJAX action that leads to Broken Access Control. Documented impact is described as allowing exploitation of incorrectly configured access control levels, with ...

CVE-2023-41865

CVE-2023-41865 : Slider Pro (WordPress plugin) ≤ 4.8.6 has a Broken Access Control issue where missing authorization on AJAX actions could allow unauthorized access. The vulnerability’s root cause is an insufficient access check on AJAX endpoints. Impact is limited to the affected plugin version ...