CVE-2022-0861

The CVE-2022-0861 entry describes a XML External Entity vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) versions prior to 5.10 Update 13. A remote administrator can upload a crafted XML file via the extension import functionality, with impact limited to some leakage of confidential ...

CVE-2024-56699

In CVE-2024-56699, the Linux kernel on s390 PCI (zPCI) could double-remove a hotplug slot due to zpci_exit_slot() being moved to zpci_release_device() and released only after all refs dropped. The non-reserved path tear-down incorrectly affected both configured and standby states, risking hotplug...

CVE-2024-53181

CVE-2024-53181 refers to a Linux kernel vulnerability where vector_device_release could crash due to using drvdata after release. The fix removes drvdata access in release and uses container_of() to obtain the vector_device instance, preventing a crash and kernel panic from a segfault. The issue ...

CVE-2016-8743

The CVE-2016-8743 issue affects Apache HTTP Server. It concerns how whitespace is accepted in requests and sent in response lines and headers in all releases before 2.2.32 and 2.4.25. The root problem is liberal whitespace handling, which can enable request smuggling, response splitting, and cach...

CVE-2024-53195

CVE-2024-53195 : In the Linux kernel (arm64 KVM), a flawed use of userspace_irqchip_in_use can trigger a WARN_ON in kvm_timer_update_irq() during VM/vCPU interactions when a PMU (KVM_ARM_VCPU_PMU_V3) is requested but not fully initialized. The described scenario: a VM is created, vCPU initialized...

CVE-2022-0857

CVE-2022-0857 describes a reflected cross-site scripting (XSS) flaw in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13. The vulnerability could let a remote attacker lure an administrator to click a crafted link, potentially exposing session information and allowing limited i...

CVE-2021-3523

3scale APICast (Red Hat 3scale) is affected in versions prior to 2.11.0. The root cause is incorrect reuse of connections, enabling an attacker to bypass API security restrictions when hosting multiple APIs on the same IP. CVSS v3.1 base score is 7.5 (HIGH); exploitation details are not provided....

CVE-2021-21999

Affected products: VMware Tools for Windows (11.x.y before 11.2.6), VMware Remote Console for Windows (12.x before 12.0.1), and VMware App Volumes (2.x before 2.18.10 and 4 before 2103). Root cause: local privilege escalation via placing a malicious file named openssl.cnf in an unrestricted direc...

CVE-2022-1502

CVE-2022-1502 affects Octopus Server/Octopus Deploy where the API failed to properly verify permissions for projects that use Git version control. The flaw allowed a user with only ProjectView permissions to modify such projects, indicating insufficient access checks in the Git-enabled workflow. ...

CVE-2020-35489

Summary (CVE-2020-35489): The WordPress plugin Contact Form 7 (before 5.3.2) is vulnerable to an unrestricted file upload leading to remote code execution because a filename can contain special characters. Affected product: WordPress Contact Form 7 plugin; affected version range: prior to 5.3.2. ...

CVE-2024-53169

CVE-2024-53169 involves the Linux kernel NVMe driver, specifically the function nvme_remove_admin_tag_set() in drivers/nvme/host/core.c. The connected bdu_fstec entry cites improper exception handling in this function, and asserts that exploitation could cause a service failure. No further techni...

CVE-2022-1656

CVE-2022-1656 affects JupiterX Theme and JupiterX Core Plugin (versions

CVE-2024-53176

The CVE covers a race in the Linux kernel SMB client (CIFS) during unmount: when unmounting, cached dentries may not be dropped due to racing with cached_dir operations, causing busy inodes and kernel BUGs. The fix introduces queued work in cfid_put_wq to drop dentries and flush it via close_all_...

CVE-2022-0842

CVE-2022-0842 affects McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13. The vulnerability is a blind SQL injection in ePO, which could let a remote authenticated attacker obtain information from the ePO database. The amount of data potentially exposed depends on the attacker’s...

CVE-2024-53234

CVE-2024-53234 : In the Linux kernel’s EROFS, a vulnerability in handling NONHEAD lclusters with delta[1] caused inadequate decompressed lengths for FIEMAP mappings. The root cause was unconditional bailing when delta[1]==0 for NONHEAD lclusters, which could affect crafted images/filesystems from...

CVE-2024-3832

CVE-2024-3832 affects Google Chrome/Chromium via the V8 engine. Description: object corruption in V8 prior to 124.0.6367.60 could be exploited by a crafted HTML page to trigger a remote issue. Affected software: Chromium/Chrome (Chromium-based browser). Underlying cause: object corruption in V8 a...

CVE-2024-53184

CVE-2024-53184 affects the Linux kernel ubd subsystem, where release-time drvdata access could cause crashes during device removal. The fix replaces drvdata usage with container_of() to locate the ubd instance, preventing a NULL-deref crash when removing a ubd device. The advisories (Unity Linux ...

CVE-2023-38169

CVE-2023-38169 is a Microsoft SQL OLE DB Remote Code Execution vulnerability. Public sources confirm the issue affects Microsoft SQL OLE DB/ODBC components (e.g., OLE DB Driver for SQL Server and SQL Server client libraries) and can be exploited remotely via a network to run code with high impact...

CVE-2025-25202

CVE-2025-25202 affects Ash Authentication (Elixir) in installations bootstrapped with the igniter installer from v4.1.0 up to but not including v4.4.9. The issue is that magic link tokens—as well as tokens revoked manually—could be verified as valid even after revocation, effectively making magic...

CVE-2022-2227

GitLab CE/EE vulnerability CVE-2022-2227: Improper access control in the runner jobs API allows a previous maintainer of a project with a specific runner to access job and project metadata. Affected versions: all prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1. The provided docum...

CVE-2022-44543

The CVE-2022-44543 issue affects the TYPO3 femanager extension (versions prior to 5.5.2, 6.x prior to 6.3.3, and 7.x prior to 7.0.1). The vulnerability arises from mishandling the usergroup.inList protection, enabling creation of frontend users in restricted groups when a usergroup field is prese...

CVE-2024-57838

CVE-2024-57838 affects the Linux kernel on s390 where stack-depot filtering cannot de-duplicate stacks because the .irqentry.text section is empty. The root cause is that IO/EXT interrupt handlers were not correctly placed into the .irqentry.text region on s390, hindering stack trace filtering fo...

CVE-2024-53152

CVE-2024-53152 is a Linux kernel vulnerability affecting Tegra194 PCIe endpoints. The issue: when PERST# is asserted and refclk is disabled, endpoint cleanup paths (dw_pcie_ep_cleanup and pci_epc_deinit_notify) access hardware registers, crashing the endpoint due to host-required refclk. The fix ...

CVE-2022-1442

CVE-2022-1442 affects the WordPress Metform plugin up to version 2.1.3. The vulnerability stems from improper access control in the ~/core/forms/action.php file, allowing an unauthenticated attacker to view API keys and secrets for multiple integrated third‑party services (e.g., PayPal, Stripe, M...

CVE-2024-56533

The CVE-2024-56533 vulnerability affects the Linux kernel’s ALSA usx2y driver. It stems from using snd_card_free() during USB disconnection, which waits for all open fds to close and can delay release, potentially blocking USB IOCTLs and causing a soft lockup. The advisory notes replacing snd_car...

CVE-2024-53193

CVE-2024-53193 – Linux kernel (Loongson2 clock) vulnerability : A memory corruption bug occurred in loongson2_clk_provider where a flexible array member (clk_hw_onecell_data.hws) was placed in the middle of the provider struct, causing clp->clk_lock to be overwritten during allocation and writ...

CVE-2022-1338

The CVE-2022-1338 entry affects the WordPress plugin Easily Generate Rest API Url (versions

CVE-2025-1413

CVE-2025-1413 affects DaVinci Resolve on macOS prior to 19.1.3. The root cause is incorrect file permissions (rwxrwxrwx) for the application, which can enable Dylib hijacking and privilege escalation for guest accounts, other users, and applications. The vulnerability is local, with high impact t...

CVE-2024-56610

CVE-2024-56610 is a Linux kernel issue where KCSAN’s report_filterlist_lock, originally protected by a non-raw spinlock, could lead to a data race on PREEMPT_RT. The patch converts the filter list lock to raw_spinlock to avoid sleeping in atomic contexts on RT kernels; it notes that memory alloca...

CVE-2024-57876

CVE-2024-57876 affects the Linux kernel DRM/DP MST code. The vulnerability arises when the MST topology is removed during reception of a Down/Up Sideband message, where drm_dp_mst_topology_mgr::up_req_recv and down_rep_recv states can be reset out of order by another thread via drm_dp_mst_topolog...

CVE-2022-2117

The CVE-2022-2117 entry concerns the WordPress plugin GiveWP . Affected versions are up to and including 2.20.2 , where the vulnerable /donor-wall REST-API endpoint exposed donor information to unauthenticated users even when the donor wall was disabled. The issue is resolved in version 2.20.2 (a...

CVE-2024-27058

CVE-2024-27058 — tmpfs race on dquot rb-tree (Linux kernel) A race was fixed in tmpfs related to handling of the dquot red-black tree. A syzkaller repro showed that fetching the rb-tree root must be protected by the dqio_sem; if the root is changed during search, shmem_release_dquot() may warn ab...

CVE-2022-30190

Technical details beyond the MSDT/Follina description are not provided in the connected documents. Public specifics (affected versions, exploit paths, patches) are not available here; monitor for updates.

CVE-2025-21663

The CVE-2025-21663 issue affects Linux kernels with the net: stmmac: dwmac-tegra driver. Root cause: the MGBE wrap SID was hard-coded to MGBE0 instead of reading the IOMMU Stream ID from the device tree, causing misconfiguration for devices other than MGBE0 and leading to timeouts or kernel panic...

CVE-2022-1559

Clipr WordPress plugin

CVE-2022-1766

CVE-2022-1766 affects Anchore Enterprise tooling (anchorectl) version 0.1.4, where credentials used to access the Anchore Enterprise API were improperly stored in the Software Bill of Materials (SBOM) generated by anchorectl. The issue enables exposure of access credentials via SBOM contents and ...

CVE-2024-56585

CVE-2024-56585 : In PREEMPT_RT Linux kernels on LoongArch, a sleeping-in-atomic-context issue arises due to a GFP flag change (GFP_KERNEL to GFP_ATOMIC) for alloc_pages_node() in setup_tlb_handler(). The underlying problem is that PREEMPT_RT replaces normal spinlocks with rt-spinlocks, and rt_spi...

CVE-2024-53159

CVE-2024-53159 is rejected/not used and does not represent an active vulnerability entry.

CVE-2022-2401

Mattermost CVE-2022-2401 affects Mattermost Server (Mattermost) up to version 6.7.0. The issue is an unrestricted information disclosure where team members can access some sensitive user information by directly calling APIs. The related records consistently cite the affected product/version and t...

CVE-2022-1431

CVE-2022-1431 affects GitLab versions 12.10.x prior to 14.8.6, 14.9.x prior to 14.9.4, and 14.10.x prior to 14.10.1. The root cause is improper handling of malicious requests to the PyPi API endpoint, allowing uncontrolled resource consumption and potential denial of service. Affected component i...

CVE-2024-9287

CVE-2024-9287 affects the CPython venv/CLI: unquoted path names when creating a virtual environment enable command injection into activation scripts (e.g., source venv/bin/activate). Affected environments can execute attacker-controlled commands upon activation; environments not created by an att...

CVE-2022-1545

GitLab CE/EE information-disclosure vulnerability (CVE-2022-1545): an unauthorised project member tagged in a note could disclose details of confidential notes created via the API. Affected versions include GitLab 13.2 up to 14.8.6, 14.9 up to 14.9.4, and 14.10 up to 14.10.1. Remediation is upgra...

CVE-2020-13957

CVE-2020-13957 affects Apache Solr configurations via the ConfigSets API. IBM and OSV/NVD sources confirm that improper access control allows bypassing security checks for dangerous features when uploading/configuring ConfigSets, potentially enabling remote code execution. Affected Solr ranges in...

CVE-2025-21691

The CVE-2025-21691 entry concerns the Linux kernel cachestat syscall. The issue arose because the cachestat() addition did not include the writability/ownership permission check that mincore() had, allowing potential misuse when reading page cache stats. The connected advisories confirm a code-le...

CVE-2025-21651

Technical details about CVE-2025-21651 are not present in the provided connected documents; the materials only reference the Linux kernel hns3 issue and a fix. Monitor for updates from official sources.

CVE-2021-30047

CVE-2021-30047 affects vsftpd 3.0.3, where a denial-of-service condition can be triggered by a limited number of concurrent connections. The vulnerability arises in VSFTPD and is confirmed across multiple sources; Red Hat advisories indicate unpatched status for various RHEL versions, and Nessus ...

CVE-2022-2458

CVE-2022-2458 is an XML External Entity (XXE) vulnerability affecting IBM Business Automation Manager/Open Editions (Business Central) and Kie-Server APIs. The weakness arises from processing XML input with external entities due to a weakly configured XML parser, enabling an attacker to cause Ext...

CVE-2016-5195

CVE-2016-5195 (Dirty COW) : A race condition in the Linux kernel’s memory management (mm/gup.c) allows a local user to gain write access to read‑only mappings via a faulty copy‑on‑write handling. Affected: kernel 2.x–4.x prior to 4.8.3. Exploitation was observed in the wild around Oct 2016. Impac...

CVE-2022-2469

CVE-2022-2469 affects GNU SASL libgsasl: server-side read-out-of-bounds when interacting with a malicious authenticated GSS-API client. The CVSS metrics in the entry show NETWORK attack, LOW complexity, LOW privileges, with HIGH confidentiality and HIGH availability impact. Connected documents fr...

CVE-2024-24199

CVE-2024-24199 concerns SmartDNS. Multiple connected sources confirm a misaligned address in smartdns/src/dns.c that can cause undefined behavior. The impact statements in OSV/Ubuntu advisories indicate a potential denial of service or arbitrary code execution, depending on the environment. The C...