CVE-2025-21334

CVE-2025-21334 concerns Windows Hyper-V NT Kernel Integration VSP with a Use-After-Free vulnerability. The connected documents indicate this family (CVE-21333/21334/21335) involves host–VM communications, yields Elevation of Privilege on the host via local access, and is part of a trio with CVE-2...

CVE-2025-21333

CVE-2025-21333 is a local elevation-of-privilege vulnerability in Windows Hyper‑V NT Kernel Integration VSP. The issue is a heap-based buffer overflow in the VSP component, enabling a local attacker with Low privilege and no user interaction to gain SYSTEM rights on the host. Public materials in ...

CVE-2025-21335

CVE-2025-21335 is part of the Windows Hyper-V NT Kernel Integration VSP elevation-of-privilege family. Connected sources confirm three related CVEs: CVE-2025-21333 (heap-based buffer overflow), CVE-2025-21334 (use-after-free), and CVE-2025-21335 (use-after-free). The vulnerability affects the hos...

CVE-2024-13159

CVE-2024-13159: Ivanti Endpoint Manager (EPM) is affected by an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information. The issue affects EPM versions prior to the 2024 January Security Update and the 2022 SU6 January 2025 Security Update...

CVE-2024-13160

Ivanti Endpoint Manager (EPM) – CVE-2024-13160 – is an absolute path traversal vulnerability that can be exploited remotely by an unauthenticated attacker to leak sensitive information. The weakness resides in the EPM’s handling of directory paths, allowing access to unintended files. Affected pr...

CVE-2024-13161

CVE-2024-13161 concerns Ivanti Endpoint Manager (EPM) where an absolute path traversal/credential-coercion issue was reported in the GetHashForSingleFile endpoint. The NUCLEI template confirms unauthenticated access could coerce the EPM machine account credential by triggering NTLM authentication...

CVE-2024-55591

CVE-2024-55591 is a critical authentication bypass affecting FortiOS and FortiProxy. Public PoCs describe remote exploitation via WebSocket/Telnet management interfaces to gain super-admin privileges without valid credentials. Affected versions include FortiOS 7.0.0–7.0.16 and FortiProxy 7.0.0–7....

CVE-2024-7344

Public documents provided do not include detailed technical information for CVE-2024-7344 (Howyar UEFI Reloader). No vendor advisories with root cause, impact, or remediation are present here. Monitor sources for updates.

CVE-2024-12877

CVE-2024-12877 affects GiveWP – Donation Plugin and Fundraising Platform for WordPress (versions up to and including 3.19.2). Root cause: unsafe deserialization of untrusted input from donation forms, enabling PHP Object Injection; the presence of a POP chain can allow deletion of arbitrary files...

CVE-2025-0107

CVE-2025-0107 – Palo Alto Networks Expedition OS command injection . The connected templates confirm an OS command injection in Palo Alto Networks Expedition that allows an unauthenticated attacker to execute arbitrary OS commands as the www-data user, leading to disclosure of usernames, cleartex...

CVE-2024-12847

The vulnerability CVE-2024-12847 affects NETGEAR DGN1000 routers (prior to firmware version 1.1.00.48). The issue is an authentication bypass in the setup.cgi endpoint that lets a remote, unauthenticated attacker execute arbitrary OS commands as root. Impact is described as remote command executi...

CVE-2024-12802

CVE-2024-12802 affects SonicWall SSL-VPN. The root cause is separate handling of UPN and SAM account names when integrated with Active Directory, enabling MFA to be configured independently for each login method and potentially allowing MFA bypass via the alternative account name. Affected produc...

CVE-2024-53704

CVE-2024-53704 affects SonicWall SonicOS SSLVPN. An improper authentication vulnerability in the SSLVPN authentication mechanism allows remote attackers to bypass authentication and hijack active VPN sessions. Affected versions include SonicOS SSLVPN 7.1.1-7040 before 7.1.3-7015 and 7.1.2-7019. P...

CVE-2025-0283

Technical details for CVE-2025-0283 are not publicly available in the provided documents. Connected items cover CVE-2025-0282 and related advisories, but do not specify affected products, impacts, or fixes for CVE-2025-0283. Monitor for updates.

CVE-2025-0282

CVE-2025-0282 is a stack-based buffer overflow in Ivanti Connect Secure (pre-auth) that enables remote code execution. Affected products include Ivanti Connect Secure, Policy Secure, and Ivanti Neurons for ZTA Gateways, with vulnerable versions listed as 22.7R2.5 (Connect Secure), 22.7R1.2 (Polic...

CVE-2024-11350

The CVE-2024-11350 entry concerns the WordPress AdForest theme (versions up to and including 5.1.6). Technical details from connected sources show a privilege escalation via account takeover: the plugin does not properly validate a user’s identity before updating passwords in adforest_reset_passw...

CVE-2024-50603

CVE-2024-50603 in Aviatrix Controller (versions < 7.1.4191 for 7.1.x and

CVE-2024-54006

CVE-2024-54006 affects the Hewlett Packard Enterprise 501 Wireless Client Bridge web interface. Multiple command-injection vulnerabilities allow authenticated remote command execution, enabling an attacker with administrative credentials to run arbitrary commands as a privileged OS user. The CVSS...

CVE-2024-48455

CVE-2024-48455 affects multiple Netis routers (e.g., NX10, NC65/NC63/NC21, MW5360) with a information disclosure vulnerability in the web component skk_get.cgi. An unauthenticated remote attacker can obtain sensitive configuration details via the mode_name and wl_link parameters. Connected docume...

CVE-2024-48456

CVE-2024-48456 affects Netis WiFi routers including NX10 (2.0.1.3643/2.0.1.3582), NC65 (3.0.0.3749), NC63 (3.0.0.3327–3.0.0.3503), NC21 (3.0.0.3800/3.0.0.3500/3.0.0.3329), and MW5360 (1.0.1.3442/1.0.1.3031). It enables a remote attacker to obtain sensitive information by abusing the password para...