CVE-2021-24042

The CVE-2021-24042 entry describes a vulnerability in WhatsApp clients where calling logic during 1:1 calls could trigger an out-of-bounds write. Affected products/versions: Android WhatsApp before v2.21.23; Android WhatsApp Business before v2.21.23; iOS WhatsApp before v2.21.230; iOS WhatsApp Bu...

CVE-2025-48617

A permissions bypass in the overrideConfig function of CarrierConfigLoader.java allows for a UID check bypass within the Android System component. This vulnerability can lead to a local escalation of privilege without requiring additional execution privileges or user interaction. This issue is ad...

CVE-2024-23131

Autodesk AutoCAD STP file parsing memory corruption vulnerability leading to remote code execution. The issue occurs when parsing STP files, with the memory corruption exploitable to run code in the current process. Descriptions from ZDI advisories confirm a remote code execution condition requir...

CVE-2024-23123

CVE-2024-23123 affects Autodesk AutoCAD when parsing CATPART files via CC5Dll.dll and ASMBASE228A.dll. The vulnerability is an out-of-bounds write in the parsing path, which can lead to a crash, data corruption, or execution of arbitrary code in the context of the current process. Exploitation co...

CVE-2024-23128

CVE-2024-23128 relates to Autodesk AutoCAD: parsing of MODEL files in libodxdll.dll and ASMDATAX229A.dll can trigger a memory corruption via write access violation, potentially enabling code execution in the current process. Connected sources (ZDI advisories) describe remote code execution with m...

CVE-2024-23136

Autodesk AutoCAD is affected by CVE-2024-23136 due to a malicious STP file parsed by ASMKERN228A.dll that can cause a dereference of an untrusted pointer, potentially enabling code execution in the current process. The CVSS indicates local access, no privileges required, user interaction required...

CVE-2024-23132

CVE-2024-23132 concerns Autodesk AutoCAD desktop software. A maliciously crafted STP file is processed by the atf_dwg_consumer.dll library, causing a memory corruption via a write-access violation. In the context of the current process, this can lead to code execution. Multiple sources corroborat...

CVE-2013-3900

CVE-2013-3900 describes a remote code execution in the WinVerifyTrust Authenticode verification for PE files. An attacker could modify a signed executable to execute code without invalidating the signature, potentially gaining full control of the system. Microsoft republished this CVE in the Secu...

CVE-2024-23122

Summary: CVE-2024-23122 affects Autodesk AutoCAD via parsing of malicious 3DM files in opennurbs.dll, causing an Out-of-Bounds Write. This can crash the process, corrupt data, or allow arbitrary code execution in the current process. Exploitation details in connected sources indicate remote code ...

CVE-2023-50387

CVE-2023-50387 (KeyTrap) affects DNSSEC processing in DNS resolvers. Multiple advisories note excessive CPU/DoS risk when validating DNSKEY/RRSIG in zones with many records. Affected products include Bind (bind9) and Unbound across Linux distributions (e.g., AL2, AlmaLinux) with patches/released ...

CVE-2021-47549

CVE-2021-47549 affects the Linux kernel via the sata_fsl driver. The documented issue is a use-after-free (UAF) in sata_fsl_port_stop triggered during rmmod sata_fsl.ko on PPC64 GNU/Linux, where after port_stop is invoked, an ioread32 on hcr_base leads to a kernel OOPS and potential memory access...

CVE-2023-36237

A Cross Site Request Forgery (CSRF) vulnerability exists in Bagisto versions prior to v.1.5.1 . This flaw allows an attacker to execute arbitrary code by delivering a crafted HTML script to a victim. To remediate this issue, users should update to version 1.5.1 or later. As a temporary workaround...

CVE-2024-23121

CVE-2024-23121 relates to Autodesk AutoCAD, where parsing of a malicious MODEL file via the libodxdll.dll component can trigger an out-of-bounds write. This vulnerability may allow a locally or remotely processed attack to crash, corrupt data, or execute arbitrary code within the caller’s process...

CVE-2024-23125

CVE-2024-23125 : The provided connected documents confirm a vulnerability in Autodesk AutoCAD where parsing a malicious SLDPRT file via the ODXSW_DLL.dll component triggers a stack-based overflow. The impact as stated is a crash, potential data exposure, or arbitrary code execution in the affecte...

CVE-2024-25756

The Tenda AC9 v.3.0 wireless router is susceptible to a Stack Based Buffer Overflow vulnerability in firmware version v.15.03.06.42_multi . A remote attacker can exploit this flaw via the formWifiBasicSet function to execute arbitrary code. No specific remediation or exploit links are provided in...

CVE-2024-25753

The Tenda AC9 v.3.0 wireless router, running firmware version v.15.03.06.42_multi , contains a Stack Based Buffer Overflow vulnerability. A remote attacker can exploit this flaw via the formSetDeviceName function to achieve arbitrary code execution . While specific exploit links or remediation st...

CVE-2019-11358

CVE-2019-11358 is a prototype pollution vulnerability in jQuery (before 3.4.0) where mishandling of extend(true, {}, ...) can extend Object.prototype if an unsanitized source object has an enumerable proto property. The Core issue is triggered when a polluted prototype is introduced via nested ob...

CVE-2024-22544

A vulnerability exists in the Linksys Router E1700 (version 1.0.04, build 3 ) involving the setDateTime function. This issue allows authenticated attackers to achieve arbitrary code execution due to improper neutralization of special elements used in a command. Impacting the device's integrity, c...

CVE-2024-54126

CVE-2024-54126 affects the TP-Link Archer C50. The root cause is an improper signature verification in the firmware upgrade process via the web interface. An attacker with administrative privileges within the router’s Wi‑Fi range can upload and execute malicious firmware, potentially resulting in...

CVE-2017-8890

CVE-2017-8890 is a Linux kernel vulnerability affecting the IPv4 networking stack. The issue is a double free in inet_csk_clone_lock() in net/ipv4/inet_connection_sock.c, which can be triggered via the accept() system call and leads to a denial of service (kernel memory corruption/crash). The Cen...

CVE-2017-9788

Apache httpd versions prior to 2.2.34 and 2.4.x before 2.4.27 are vulnerable to a memory management flaw in the mod_auth_digest module. The value placeholder in [Proxy-]Authorization headers of type 'Digest ' is not properly initialized or reset between successive key=value assignments. An attack...

CVE-2016-6515

OpenSSH sshd vulnerability CVE-2016-6515 arises from the auth_password function not enforcing a maximum password length for password authentication, allowing remote, unauthenticated attackers to trigger high CPU consumption and denial of service via a long input string. Affected products: OpenSSH...

CVE-2015-6564

A use-after-free vulnerability exists in the mm_answer_pam_free_ctx function within monitor.c of the OpenSSH sshd daemon (versions before 7.0 on non-OpenBSD platforms). An attacker can exploit this by leveraging control of the sshd uid to send an unexpectedly early MONITOR_REQ_PAM_FREE_CTX reques...

CVE-2025-49641

CVE-2025-49641 affects Zabbix deployments; a regular user without access to Monitoring → Problems can call problem.view.refresh and retrieve a list of active problems. Root cause described as insufficient permission checks for the problem.view.refresh action. The connected sources (Red Hat, Debia...

CVE-2023-42793

CVE-2023-42793 affects JetBrains TeamCity prior to 2023.05.4, where an authentication bypass can lead to remote code execution (RCE) on the TeamCity server. Public evidence includes multiple PoC and exploit scripts on GitHub and Exploit-DB describing admin account creation and RCE workflows, with...

CVE-2022-26522

The aswArPot.sys driver in Avast and AVG Windows Anti Rootkit products prior to version 22.1 contains a double fetch vulnerability at aswArPot+0xc4a3 within the socket connection handler. This flaw allows local attackers to achieve arbitrary code execution in kernel mode or trigger a denial of se...

CVE-2024-2169

Implementations of the UDP application protocol are vulnerable to network loops due to a flaw in how certain UPD protocol implementations handle traffic. An unauthenticated attacker can exploit this by sending maliciously crafted packets to a vulnerable system, potentially causing a Denial of Ser...

CVE-2021-46973

CVE-2021-46973 is a Linux kernel use-after-free in the MHI path for qrtr (net: qrtr: Avoid potential use after free in MHI send). The issue occurs because the MHI ul_callback could run immediately after queuing an skb, potentially decrementing the associated skb’s refcount and freeing it, which m...

CVE-2023-52923

CVE-2023-52923 affects the Linux kernel netfilter nf_tables backend. The vulnerability arises from switching to the GC transaction API to replace the old gc API and busy-mark approach. No set elements are removed during async GC anymore; the _DEAD bit is set to hide elements from lookups, and asy...

CVE-2024-25260

The elfutils v0.189 package contains a NULL pointer dereference vulnerability within the handle_verdef() function located in readelf.c. This flaw can impact various environments, including EDB PGAI Databases 18.0 , where it is addressed in version 18.2 , and TencentOS Server 4 , where updates are...

CVE-2018-25032

CVE-2018-25032 affects zlib prior to 1.2.12 and causes memory corruption during deflate when the input contains many distant matches. The linked Astra Linux advisory reiterates the zlib memory corruption in zlib before 1.2.12, and multiple Mariner/CBL advisories show affected packages (e.g., teck...

CVE-2024-26327

CVE-2024-26327 affects QEMU 7.1.0–8.2.1, where register_vfs in hw/pci/pcie_sriov.c mishandles a guest write of NumVFs greater than TotalVFs, resulting in a buffer overflow in VF implementations. This is documented across multiple sources (e.g., Astra Linux security bulletin) and related entries d...

CVE-2022-26523

The aswArPot.sys driver in the Avast and AVG Windows Anti Rootkit driver (versions before 22.1) contains a double fetch vulnerability at aswArPot+0xbb94. This flaw in the socket connection handler allows local attackers to execute arbitrary code in kernel mode or cause a denial of service through...

CVE-2022-4039

CVE-2022-4039 affects Red Hat Single Sign-On for OpenShift container images where an unsecured management interface is enabled. Connected sources describe the flaw as allowing an attacker to use the management interface to deploy malicious code and to access/modify potentially sensitive informati...

CVE-2021-26855

CVE-2021-26855 is an Exchange Server SSRF vulnerability that enables pre-auth access to Exchange backend and, when chained with CVE-2021-27065, can lead to remote code execution. Public exploitation activity and PoCs (e.g., Nmap http-vuln-cve2021-26855 scripts and curl demonstrations) illustrate ...

CVE-2024-36387

The Apache HTTP Server is vulnerable to a denial of service (DoS) attack due to a NULL Pointer dereference flaw. This issue occurs when the server handles WebSocket protocol upgrades over an HTTP/2 connection via a specially crafted request, which can cause the server process to crash and degrade...

CVE-2024-30172

An issue exists in the Bouncy Castle Java Cryptography APIs before version 1.78 (starting in 1.73), where a crafted signature and public key can trigger an infinite loop during Ed25519 verification. This vulnerability can lead to a Denial of Service (DoS) , as evidenced by several high-severity f...

CVE-2023-39325

CVE-2023-39325 describes a DoS in HTTP/2 handling where a malicious client rapidly creates and resets requests, potentially exhausting server resources. The fix tightens per-connection concurrency handling: servers bound the number of executing handler goroutines to the stream-concurrency limit (...

CVE-2013-5148

CVE-2013-5148 affects Apple Keynote versions older than 6.0, where Keynote in Presentation mode may bypass or leave screen lock disengaged during sleep, enabling a physically proximate attacker to access an unattended Mac. Concrete details across connected sources show the vulnerability is tied t...

CVE-2023-28465

CVE-2023-28465 affects HL7 FHIR Core Libraries prior to 5.6.106. The vulnerability stems from the package‑decompression feature, allowing directory traversal that enables copying arbitrary files to certain directories when an attacker’s chosen path contains a substring of an allowed directory nam...

CVE-2024-35311

Yubico security keys including the YubiKey 5 Series , Security Key Series , YubiKey Bio Series , and YubiKey 5 FIPS are vulnerable to Incorrect Access Control . The flaw allows an attacker with physical access to the key or local access to the user's device to bypass user verification prompts and...

CVE-2024-40075

The Laravel v11.x framework is susceptible to an XML External Entity (XXE) vulnerability (CWE-611). This flaw allows attackers to manipulate XML entities to potentially access unauthorized data or execute system-level commands . While a proof-of-concept was published on 2024-07-24, no specific pa...

CVE-2021-29050

A Cross-Site Request Forgery (CSRF) vulnerability exists in the terms of use page of Liferay Portal and Liferay DXP . The root cause is insufficient validation of requests, which allows remote attackers to use social engineering to trick users into visiting a malicious page and accepting the site...

CVE-2022-21384

CVE-2022-21384 is a duplicate of CVE-2021-39275 per the initial description. Connected sources provide concrete details for CVE-2021-39275: an out-of-bounds write in ap_escape_quotes() in Apache httpd, enabling a remote attacker to crash or potentially execute code. Affected products include all ...

CVE-2022-44228

Technical details for CVE-2022-44228 are not publicly available in the provided documents. No confirmed impact, affected products, or remediation are described here. Monitor for future updates.

CVE-2025-3500

CVE-2025-3500 describes an Integer Overflow/Wraparound in Avast Antivirus for Windows (affected: 25.1.981.6 up to but before 25.3). The root cause is an overflow in AvastResourceParser::AllocateBuffer(int size) where size * sizeof(struct) can under-allocate a buffer, enabling privilege escalation...

CVE-2024-4469

The WP STAGING WordPress Backup Plugin (versions prior to 3.5.0 ) is vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is a lack of prevention for users with the administrator role to perform pinging operations, which can be particularly problematic in multisite configurations ....

CVE-2020-9490

CVE-2020-9490 affects Apache HTTP Server versions 2.4.20–2.4.43. A specially crafted value for the Cache-Digest header in an HTTP/2 request could cause a crash when the server subsequently attempts to HTTP/2 PUSH a resource. Mitigation for unpatched servers is to disable HTTP/2 PUSH via H2Push of...

CVE-2022-20128

CVE-2022-20128 is rejected/withdrawn by its CNA and does not represent an active vulnerability entry.

CVE-2016-8612

CVE-2016-8612 affects Apache HTTP Server mod_cluster prior to httpd 2.4.23, with a flaw in the protocol parsing logic of the load balancer that can cause a Segmentation Fault in the httpd process due to improper input validation. Exploitation details are not provided in the connected documents; r...