CVE-2024-00000

Mitel MiCollab (9.8 SP1 FP2 / 9.8.1.201 and earlier) is affected by CVE-2024-41713, described as an Authentication Bypass that enables Arbitrary File Read (path traversal). An exploit targeting this vulnerability exists (watchTowr/MiCollab exploitation repo) and demonstrates reading arbitrary fil...

CVE-2024-0000

Vulnerability overview (CVE-2024-0000): VMware vCenter Server versions prior to the latest patch release are affected by a critical flaw in the vSphere Client component that allows unauthenticated remote code execution, enabling attackers to potentially take full control of vulnerable servers. Th...

CVE-2024-48326

Portabilis i-Educar is affected (versions 2.8.0 and 2.9.0 referenced in connected sources). The vulnerability is a stored XSS in the nm_religiao parameter of the /intranet/educar_religiao_cad.php POST and /intranet/educar_religiao_lst.php?busca=S&nm_religiao= GET endpoints. An unauthenticated att...

CVE-2022-25476

Technical details for CVE-2022-25476 are not publicly available in the provided documents. Monitor for updates as information may be released by the reserving organization.

CVE-2021-26121

CVE-2021-26121 affects CSCart (CS-Cart Multivendor) via the templates.manage Server-Side Template Injection, enabling remote code execution. The root cause is lack of sandboxing in Smarty templates, allowing a shop admin (with at least Files privileges) to inject and execute code on the server. E...

CVE-2023-39024

Harman Media Suite Portal Settings). An exploit/POC exists (C20FE0B5-806A-56; POC for CVE-2023-39024 and CVE-2023-39025) showing the vulnerability context. Note: whether other extensions like SSRF (CVE-2023-39025) are separately exploitable is indicated by the PoC, but the core CVE-2023-39024 de...

CVE-2024-37010

CVE-2024-37010 is an OwnCloud external-storage IDOR vulnerability where an authenticated user can modify another user’s external storage configuration without proper rights verification. The exploit description demonstrates that updating the target's external storage can change the storage’s name...

CVE-2024-42587

CVE-2024-42587 is linked to SSTI in Jinja2 affecting promptify v2.0.3, per PT-2024-30049/PT-2024-30050 entries. The connected docs identify the issue type (SSTI) and component/version but do not provide further technical details, root cause specifics, exploitability, or remediation guidance. No e...

CVE-2024-42588

CVE-2024-42588 affects promptify 2.0.3 with a remote code execution (RCE) issue labeled in PT-2024-30049/30050 entries as “RCE” associated with eval. The connected docs do not provide exploit details, affected vectors beyond the component/version, or remediation steps. No explicit root cause desc...

CVE-2024-41312

CVE-2024-41312 corresponds to a Stored XSS in InstantCMS, evidenced by a public exploit referencing InstantCMS 2.16.3. The vulnerability occurs via image metadata during the photos upload flow (e.g., embedding payload in the Camera Model Name field) and is triggered when accessing a crafted URL l...

CAN-2003-0826

The CAN-2003-0826 entry is supported by multiple connected advisories and vulnerability feeds describing a heap buffer overflow in lshd (the lsh server component) that could allow remote execution of arbitrary code. Debian’s DSA-717-1 documents CAN-2003-0826 (and CAN-2005-0814) as remote vulnerab...

CAN-2005-1921

CVE-2005-1921 is tied to PHPXMLRPC (XML-RPC for PHP), with a remote code execution flaw in the PHPXMLRPC library. Affected product/version: PHPXMLRPC

CAN-2005-2095

CAN-2005-2095 affects SquirrelMail (PHP4)

CAN-2005-2250

CVE-2005-2250 affects the Nokia Affix Bluetooth FTP client (BTFTP) in Affix 2.1.2 and 3.2.0, where a buffer overflow via a long filename in an OBEX file share allows remote code execution. Debian and OSS advisories flag CAN-2005-2250 and note remediation by updating the affix package to fixed rel...

CAN-2005-0989

CVE-2005-0989 is a vulnerability in the Mozilla family (Firefox/Thunderbird) JavaScript engine related to regular-expression based string replacement. Connected advisories confirm the issue involves the vulnerability in the JavaScript interpreter that can cause information disclosure from heap me...

CAN-2005-2265

Technical details for CVE-2005-2265 are not publicly available in the provided documents. Monitor for updates from trusted sources.

CAN-2002-0388

CVE-2002-0388 is a cross-site scripting vulnerability in Mailman, discussed across Debian advisories (DSA-147-1/147-2) and related OpenVAS entries. The issue arises when a crafted URL is viewed in Internet Explorer, causing the page to render with embedded JavaScript, potentially exposing sensiti...

CAN-2002-0662

CVE-2002-0662 affects ScrollKeeper, specifically versions 0.3 to 0.3.11, where scrollkeeper-get-cl creates temporary files insecurely in /tmp. This enables local users to fabricate or overwrite files via a symlink attack on the scrollkeeper-tempfile.x files, as described in Debian advisory DSA-16...

CAN-2002-0838

CVE-2002-0838 corresponds to a buffer overflow in gv, the PostScript/PDF viewer used by gnome-gv. The same code is present in gv/gnome-gv. Exploitation is achieved by processing a malformed PostScript or PDF file, allowing arbitrary code execution with the victim’s privileges. Debian and Gentoo/O...

CAN-2002-1220

CVE-2002-1220 affects BIND 8, versions 8.3.x through 8.3.3. A remote attacker can cause a denial of service (termination due to assertion failure) by requesting a subdomain that does not exist with an OPT RR containing a large UDP payload. Debian/DSA-196-1 notes a fix in 8.3.3-2.0woody1; other Op...