CVE-2022-28345

The CVE-2022-28345 issue affects the Signal iOS app prior to version 5.34, where RTLO-injected, RTLO-encoded URLs beginning with an unbroken space (in the presence of a hash segment) can be rendered to resemble legitimate sites. An unauthenticated remote attacker could exploit this to spoof links...

CVE-2019-12815

Summary: CVE-2019-12815 is a vulnerability in ProFTPD’s mod_copy that allowed unauthenticated remote access to copy arbitrary files due to incomplete CPFR/CPTO permission checks, enabling remote code execution and information disclosure. Affected software: ProFTPD up to 1.3.5b (and related 1.3.5 ...

CVE-2021-33146

Mode C: CVE-2021-33146 affects Intel Ethernet Adapters and Intel Ethernet Controller I225 Manageability firmware. The core issue is improper input validation that may allow an unauthenticated user to disclose information over the network. Public references indicate affected firmware prior to NVM ...

CVE-2014-0098

CVE-2014-0098 affects the Apache HTTP Server (mod_log_config) prior to version 2.4.8. The vulnerability is caused by how log_cookie is handled during truncation, allowing remote attackers to trigger a denial-of-service (segmentation fault and daemon crash). Public advisories and vendor notes (e.g...

CVE-2022-29146

CVE-2022-29146 is a Microsoft Edge (Chromium-based) Elevation of Privilege vulnerability. CVSS v3.1 base score 8.3 (HIGH) with network attack vector, high attack complexity, no privileges required, user interaction required, scope changed; impacts include confidentiality, integrity and availabili...

CVE-2022-3172

CVE-2022-3172 : Kubernetes kube-apiserver SSRF vulnerability allowing an aggregated API server to redirect client traffic to an arbitrary URL, potentially causing unintended actions and leaking API server credentials. Connected sources confirm affected product families (kube-apiserver) and that a...

CVE-2023-21713

CVE-2023-21713 is a Microsoft SQL Server remote code execution vulnerability. The CVE is addressed in the February 2023 security updates for SQL Server 2019/GDR (KB5021125) and related KBs, which list CVE-2023-21713 among addressed issues. The vulnerability affects SQL Server components and is mi...

CVE-2025-23217

CVE-2025-23217 affects mitmweb (the web UI of mitmproxy). In versions 11.1.1 and earlier, a malicious client connected to mitmweb’s proxy server (default bind 0.0.0.0:8080) could reach mitmweb’s internal API (127.0.0.1:8081) through the proxy, enabling SSRF-style access that may lead to remote co...

CVE-2021-33162

CVE-2021-33162 : Improper access control in some Intel® Ethernet Adapters and Intel® Ethernet Controller I225 Manageability firmware may allow an authenticated local user to escalate privileges. The issue is documented by Intel in advisory Intel-SA-00756 and is rated high (CVSSv3.1 base 8.4). Aff...

CVE-2008-6471

SQL injection vulnerability in MountainGrafix easyLink 1.1.0 affects detail.php via the cat parameter in a show action, allowing remote attackers to execute arbitrary SQL commands. This is the explicit root cause described in CVE-2008-6471. The connected records corroborate the same description f...

CVE-2023-32373

CVE-2023-32373 is a use-after-free in WebKitGTK/WebKit related to processing malicious web content. Connected advisories confirm this vulnerability affects WebKitGTK/WebKit components and note exploitation activity. The issue is fixed in WebKitGTK/WebKit updates (e.g., webkitgtk4 packages) across...

CVE-2019-2725

CVE-2019-2725 is an Oracle WebLogic Server vulnerability (Web Services subcomponent) that allows unauthenticated, network-based remote code execution via HTTP. Affected versions include Oracle WebLogic Server 10.3.6.0.0 and 12.1.3.0.0. The root cause is deserialization of untrusted objects in Web...

CVE-2019-1010208

CVE-2019-1010208 affects Veracrypt/NT Driver (veracrypt.sys) and prior Truecrypt/IDRIX implementations. Root cause: Buffer Overflow in the Veracrypt NT Driver leading to information disclosure on the kernel stack. Impact stated as partial kernel stack information disclosure; attack vector is loca...

CVE-2024-35796

The CVE-2024-35796 vulnerability concerns the Linux kernel net/ ll_temac code where platform_get_resource was replaced by devm_platform_ioremap_resource_byname and invoked with a 0-length name, leading to a path that ends up calling platform_get_resource_byname and dereferencing a NULL pointer in...

CVE-2021-33157

CVE-2021-33157 affects Intel® Ethernet Adapters and Intel® Ethernet Controller I225 Manageability firmware, where insufficient control flow management could allow a privileged user to escalate privileges via local access. The base CVSSv3.1 score is 7.2 (HIGH) with LOCAL access, HIGH complexity, a...

CVE-2019-10081

CVE-2019-10081 affects Apache httpd's HTTP/2 implementation (mod_http2) where very early pushes can overwrite memory in the pushing request’s pool, causing crashes. The vulnerable facet is the handling of push headers (not client data) and memory being copied from the configured push link header ...

CVE-2022-1902

CVE-2022-1902 describes a vulnerability in Red Hat Advanced Cluster Security for Kubernetes where Notifier secrets were not properly sanitized in the GraphQL API. This allows authenticated ACS users to retrieve Notifiers via GraphQL, potentially escalating privileges. CVSSv3.1 base score 8.8 (HIG...

CVE-2022-2083

CVE-2022-2083 affects the WordPress plugin “Simple Single Sign On”

CVE-2021-43160

CVE-2021-43160 affects Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55. The vulnerability arises in the switchFastDhcp function under /cgi-bin/luci/api/diagnose, enabling remote code execution. The connected sources specify the affected product and the vulnerable component, ...

CVE-2021-39390

CVE-2021-39390 describes a Stored XSS in PartKeepr 1.4.0. The vulnerability arises in the edit module where multiple API endpoints accept a name parameter without proper sanitization/validation, allowing injection of JavaScript that can be executed in the client browser. Affected software: PartKe...

CVE-2021-33145

CVE-2021-33145 refers to an uncaught exception in Intel® Ethernet Adapters and Intel® Ethernet Controller I225 Manageability firmware that may allow a privileged local escalation. Red Hat and Intel advisories corroborate the same description, with affected products including Intel® Ethernet Contr...

CVE-2021-33141

The CVE-2021-33141 issue affects Intel® Ethernet Adapters and Intel® Ethernet Controller I225 Manageability firmware. The root cause is improper input validation in the firmware, which may allow an unauthenticated user to cause a denial of service via network access. The CVSS v3.1 base score is 8...

CVE-2024-38475

CVE-2024-38475 affects Apache HTTP Server 2.4.59 and earlier, where improper escaping of output in mod_rewrite can map URLs to filesystem locations that are served but not directly reachable, enabling remote code execution or source code disclosure. The issue also involves substitutions in server...

CVE-2019-7659

Genivia gSOAP 2.7.x and 2.8.x are affected by CVE-2019-7659 if a server application is built with -DWITH_COOKIES. The vulnerability exists in the C/C++ libraries libgsoapck/libgsoapck++ and libgsoapssl/libgsoapssl++ when built with that flag, enabling denial of service (application abort) and pos...

CVE-2021-33161

The CVE-2021-33161 issue concerns improper input validation in Intel Ethernet Adapters and Intel Ethernet Controller I225 Manageability firmware, enabling a privileged user to escalate privileges via local access. Affected products include Intel Ethernet Controller I225 Manageability firmware (be...

CVE-2021-41003

CVE-2021-41003 affects Aruba AOS-CX API interface across Aruba CX 6200F, 6300, 6400, 8320, 8325, 8400, and CX 8360 series. Reported as multiple unauthenticated command‑injection vulnerabilities with affected AOS-CX versions: 10.06.xxxx (<=10.06.0170), 10.07.xxxx (<=10.07.0050), 10.08.xxxx (...

CVE-2025-0633

CVE-2025-0633 is a heap-based buffer overflow in iniparser_dumpsection_ini() of iniparser, allowing read of out-of-bounds memory. Connected advisories (ALAS/ALAS2, Mageia, Debian, Fedora, Red Hat, Alpine, CIRCL) confirm iniparser as the affected package and cite a patched release; specifics vary ...

CVE-2021-33142

Summary: CVE-2021-33142 affects Intel® Ethernet Adapters and Intel® Ethernet Controller I225 Manageability firmware. The common issue is improper input validation in the firmware, which may allow a privileged user to cause a denial of service via local access. Connections across sources (Intel ad...

CVE-2021-33158

CVE-2021-33158 affects Intel Ethernet Adapters and the Intel Ethernet Controller I225 Manageability firmware. Affected: Intel Ethernet Controller I225 Manageability firmware prior to NVM 1.87 and Intel Ethernet Adapters prior to version 29.0.1. Description from Intel advisory: improper neutraliza...

CVE-2024-24198

The vulnerability CVE-2024-24198 affects SmartDNS due to a misaligned address in smartdns/src/util.c within commit 54b4dc. Reported CVSSv3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates high impact to availability with no confidentiality or integrity impact. The available documents do not provid...

CVE-2024-29943

CVE-2024-29943 is a Firefox vulnerability: an attacker could perform an out-of-bounds read or write on a JavaScript object by fooling range-based bounds check elimination. Affected product: Mozilla Firefox versions earlier than 124.0.1 (desktop; ESR has separate fixes). The root cause is an incor...

CVE-2021-3426

CVE-2021-3426 corresponds to a vulnerability in Python’s pydoc where the getfile feature could be abused to read arbitrary files. The linked sources confirm the issue affects Python versions prior to specific releases (e.g., Python before 3.8.9, 3.9.3, and 3.10.0a7 per the CVE description) and no...

CVE-2025-27516

CVE-2025-27516 : Jinja2 before 3.1.6 exposes a sandbox bypass via the |attr filter, allowing arbitrary Python code execution if an attacker controls template content. Affected: jinja2 versions prior to 3.1.6. Impact: execution of code in untrusted templates. Remediation: upgrade to 3.1.6 or newer...

CVE-2021-31207

CVE-2021-31207 is one of the ProxyShell chain affecting on-premises Microsoft Exchange Server, enabling post-auth arbitrary-file-write that can lead to remote code execution. Exploitation chains documented in FireEye and related advisories describe initial steps using Autodiscover and MAPI to lea...

CVE-2019-19141

The Plex Media Server CVE-2019-19141 vulnerability affects the Camera Upload feature through version 1.18.2.2029. It permits remote authenticated users to write files anywhere the Plex process user has permissions, enabling remote code execution. The described attack path includes directory trave...

CVE-2019-14834

CVE-2019-14834 affects dnsmasq prior to 2.81 and causes a memory leak that can be exploited remotely to trigger a denial of service via DHCP response creation. Public details across multiple advisories indicate the root cause is in memory management (e.g., create_helper function and related code ...

CVE-2021-25636

CVE-2021-25636 affects The Document Foundation LibreOffice 7.2.x prior to 7.2.5. The issue arises from an Improper Certificate Validation in which a document can be crafted so that the signature verification process uses KeyValue data while reporting a mismatch with X509Data, undermining trust in...

CVE-2021-32804

The CVE-2021-32804 entry concerns the npm package tar (node-tar). Affected versions before 6.1.1, 5.0.6, 4.4.14, and 3.3.2 contain an arbitrary File Creation/Overwrite vulnerability caused by insufficient absolute path sanitization during extraction. node-tar attempts to prevent absolute paths by...

CVE-2023-24486

Citrix Workspace app for Linux is affected by a session takeover vulnerability (CVE-2023-24486) due to improper access control. An authenticated local user could gain access to another user’s Citrix Virtual Apps and Desktops session on the same machine when launching published desktops/applicatio...

CVE-2024-27028

CVE-2024-27028 is confirmed with concrete details in connected docs: the Linux kernel spi-mt65xx driver had a NULL pointer dereference in the interrupt handler during spi_transfer when tx_buf could be NULL. The fix adds a check for trans->tx_buf before use, mitigating potential crashes. Affect...

CVE-2017-7269

CVE-2017-7269 is a remote-code-execution vulnerability in the IIS 6.0 WebDAV service (ScStoragePathFromUrl) on Windows Server 2003 R2. It can be triggered by a crafted long header in a PROPFIND request beginning with "If:

CVE-2023-29542

Technical details for CVE-2023-29542 are not publicly disclosed in the provided documents. No affected products, root cause, or mitigation are specified here. Monitor for updates from the sources to obtain concrete information.

CVE-2021-25635

CVE-2021-25635 is a certificate-validation vulnerability in LibreOffice described as a Content Manipulation with Certificate Validation Attack. An attacker could enable self-signed ODF documents, then modify the signature algorithm to an invalid/unknown one; LibreOffice could display the signatur...

CVE-2020-0618

CVE-2020-0618 affects Microsoft SQL Server Reporting Services (SSRS) and is a remote code execution vulnerability caused by improper handling of page requests, with deserialization of viewstate cited in some sources. The vulnerability can allow code execution on the Report Server service account,...

CVE-2011-1002

Avahi CVE-2011-1002 affects the avahi-daemon (avahi) before 0.6.29. A remote attacker can trigger a denial of service (infinite loop) by sending an empty mDNS UDP packet to port 5353 (IPv4 or IPv6). The issue arises from an incorrect fix related to CVE-2010-2244. Public advisories and distributio...

CVE-2022-26377

CVE-2022-26377 is a real HTTP Request Smuggling vulnerability in the mod_proxy_ajp module of Apache HTTP Server. Affected: Apache httpd 2.4.53 and earlier. Description across sources confirms that an attacker can smuggle requests to the AJP server to which httpd forwards traffic. Patches/updates ...

CVE-2025-1386

CVE-2025-1386 concerns the ch-go library from github.com/ClickHouse/ch-go. The issue is a vulnerability in which, under a specific condition where a query includes large, uncompressed external data, an attacker who controls that data can smuggle another query packet into the same connection strea...

CVE-2024-57883

The CVE CVE-2024-57883 is a Linux kernel vulnerability in mm/hugetlb: independent PMD page table shared count. The root cause is an incorrect refcount increment in try_get_folio() that can be triggered by callers such as split_huge_pages, leading to a leaked PMD page table when the refcount is in...

CVE-2025-30065

CVE-2025-30065 : In Apache Parquet, the parquet-avro module (affecting Parquet 1.15.0 and earlier) allows arbitrary code execution due to schema parsing issues. Upgrading to Parquet 1.15.1 fixes the issue. The vulnerability arises from deserialization of untrusted data during schema translation f...

CVE-2014-0050

This CVE affects Apache Commons FileUpload (MultipartStream.java) before version 1.3.1, as used in Apache Tomcat, JBoss Web, and other products. The root cause is a crafted Content-Type header that bypasses the loop exit conditions, allowing remote attackers to trigger an infinite loop and high C...