CVE-2008-6471

SQL injection vulnerability in MountainGrafix easyLink 1.1.0 affects detail.php via the cat parameter in a show action, allowing remote attackers to execute arbitrary SQL commands. This is the explicit root cause described in CVE-2008-6471. The connected records corroborate the same description f...

CVE-2014-0098

CVE-2014-0098 affects the Apache HTTP Server (mod_log_config) prior to version 2.4.8. The vulnerability is caused by how log_cookie is handled during truncation, allowing remote attackers to trigger a denial-of-service (segmentation fault and daemon crash). Public advisories and vendor notes (e.g...

CVE-2021-33162

CVE-2021-33162 : Improper access control in some Intel® Ethernet Adapters and Intel® Ethernet Controller I225 Manageability firmware may allow an authenticated local user to escalate privileges. The issue is documented by Intel in advisory Intel-SA-00756 and is rated high (CVSSv3.1 base 8.4). Aff...

CVE-2022-0609

CVE-2022-0609 is a Google Chrome vulnerability described as a use-after-free in the Animation component, leading to potential heap corruption and remote code execution via a crafted HTML page. Affected product: Google Chrome (Animation). Vulnerable condition: use-after-free in the Chrome animatio...

CVE-2019-1010208

CVE-2019-1010208 affects Veracrypt/NT Driver (veracrypt.sys) and prior Truecrypt/IDRIX implementations. Root cause: Buffer Overflow in the Veracrypt NT Driver leading to information disclosure on the kernel stack. Impact stated as partial kernel stack information disclosure; attack vector is loca...

CVE-2021-33157

CVE-2021-33157 affects Intel® Ethernet Adapters and Intel® Ethernet Controller I225 Manageability firmware, where insufficient control flow management could allow a privileged user to escalate privileges via local access. The base CVSSv3.1 score is 7.2 (HIGH) with LOCAL access, HIGH complexity, a...

CVE-2024-35796

The CVE-2024-35796 vulnerability concerns the Linux kernel net/ ll_temac code where platform_get_resource was replaced by devm_platform_ioremap_resource_byname and invoked with a 0-length name, leading to a path that ends up calling platform_get_resource_byname and dereferencing a NULL pointer in...

CVE-2022-1902

CVE-2022-1902 describes a vulnerability in Red Hat Advanced Cluster Security for Kubernetes where Notifier secrets were not properly sanitized in the GraphQL API. This allows authenticated ACS users to retrieve Notifiers via GraphQL, potentially escalating privileges. CVSSv3.1 base score 8.8 (HIG...

CVE-2012-1823

CVE-2012-1823 affects PHP when run as CGI (php-cgi). The issue is that sapi/cgi/cgi_main.c mishandles query strings without an =, enabling remote code execution by passing command-line options in the query. Affected PHP versions include 5.3.x up to 5.3.12 and 5.4.x up to 5.4.2, with exploitation ...

CVE-2022-2083

CVE-2022-2083 affects the WordPress plugin “Simple Single Sign On”

CVE-2025-23217

CVE-2025-23217 affects mitmweb (the web UI of mitmproxy). In versions 11.1.1 and earlier, a malicious client connected to mitmweb’s proxy server (default bind 0.0.0.0:8080) could reach mitmweb’s internal API (127.0.0.1:8081) through the proxy, enabling SSRF-style access that may lead to remote co...

CVE-2021-33145

CVE-2021-33145 refers to an uncaught exception in Intel® Ethernet Adapters and Intel® Ethernet Controller I225 Manageability firmware that may allow a privileged local escalation. Red Hat and Intel advisories corroborate the same description, with affected products including Intel® Ethernet Contr...

CVE-2021-43160

CVE-2021-43160 affects Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55. The vulnerability arises in the switchFastDhcp function under /cgi-bin/luci/api/diagnose, enabling remote code execution. The connected sources specify the affected product and the vulnerable component, ...

CVE-2021-33141

The CVE-2021-33141 issue affects Intel® Ethernet Adapters and Intel® Ethernet Controller I225 Manageability firmware. The root cause is improper input validation in the firmware, which may allow an unauthenticated user to cause a denial of service via network access. The CVSS v3.1 base score is 8...

CVE-2021-39390

CVE-2021-39390 describes a Stored XSS in PartKeepr 1.4.0. The vulnerability arises in the edit module where multiple API endpoints accept a name parameter without proper sanitization/validation, allowing injection of JavaScript that can be executed in the client browser. Affected software: PartKe...

CVE-2021-36260

CVE-2021-36260 is a command-injection vulnerability in the web server of Hikvision products caused by insufficient input validation. Public details in the provided docs confirm an attacker can trigger remote code execution via crafted messages to the device (no authentication required in some PoC...

CVE-2021-33161

The CVE-2021-33161 issue concerns improper input validation in Intel Ethernet Adapters and Intel Ethernet Controller I225 Manageability firmware, enabling a privileged user to escalate privileges via local access. Affected products include Intel Ethernet Controller I225 Manageability firmware (be...

CVE-2021-41003

CVE-2021-41003 affects Aruba AOS-CX API interface across Aruba CX 6200F, 6300, 6400, 8320, 8325, 8400, and CX 8360 series. Reported as multiple unauthenticated command‑injection vulnerabilities with affected AOS-CX versions: 10.06.xxxx (<=10.06.0170), 10.07.xxxx (<=10.07.0050), 10.08.xxxx (...

CVE-2021-33142

Summary: CVE-2021-33142 affects Intel® Ethernet Adapters and Intel® Ethernet Controller I225 Manageability firmware. The common issue is improper input validation in the firmware, which may allow a privileged user to cause a denial of service via local access. Connections across sources (Intel ad...

CVE-2023-21713

CVE-2023-21713 is a Microsoft SQL Server remote code execution vulnerability. The CVE is addressed in the February 2023 security updates for SQL Server 2019/GDR (KB5021125) and related KBs, which list CVE-2023-21713 among addressed issues. The vulnerability affects SQL Server components and is mi...

CVE-2021-33158

CVE-2021-33158 affects Intel Ethernet Adapters and the Intel Ethernet Controller I225 Manageability firmware. Affected: Intel Ethernet Controller I225 Manageability firmware prior to NVM 1.87 and Intel Ethernet Adapters prior to version 29.0.1. Description from Intel advisory: improper neutraliza...

CVE-2019-7659

Genivia gSOAP 2.7.x and 2.8.x are affected by CVE-2019-7659 if a server application is built with -DWITH_COOKIES. The vulnerability exists in the C/C++ libraries libgsoapck/libgsoapck++ and libgsoapssl/libgsoapssl++ when built with that flag, enabling denial of service (application abort) and pos...

CVE-2025-0633

CVE-2025-0633 is a heap-based buffer overflow in iniparser_dumpsection_ini() of iniparser, allowing read of out-of-bounds memory. Connected advisories (ALAS/ALAS2, Mageia, Debian, Fedora, Red Hat, Alpine, CIRCL) confirm iniparser as the affected package and cite a patched release; specifics vary ...

CVE-2024-24198

The vulnerability CVE-2024-24198 affects SmartDNS due to a misaligned address in smartdns/src/util.c within commit 54b4dc. Reported CVSSv3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates high impact to availability with no confidentiality or integrity impact. The available documents do not provid...

CVE-2019-12815

Summary: CVE-2019-12815 is a vulnerability in ProFTPD’s mod_copy that allowed unauthenticated remote access to copy arbitrary files due to incomplete CPFR/CPTO permission checks, enabling remote code execution and information disclosure. Affected software: ProFTPD up to 1.3.5b (and related 1.3.5 ...

CVE-2019-19141

The Plex Media Server CVE-2019-19141 vulnerability affects the Camera Upload feature through version 1.18.2.2029. It permits remote authenticated users to write files anywhere the Plex process user has permissions, enabling remote code execution. The described attack path includes directory trave...

CVE-2019-2725

CVE-2019-2725 is an Oracle WebLogic Server vulnerability (Web Services subcomponent) that allows unauthenticated, network-based remote code execution via HTTP. Affected versions include Oracle WebLogic Server 10.3.6.0.0 and 12.1.3.0.0. The root cause is deserialization of untrusted objects in Web...

CVE-2024-29943

CVE-2024-29943 is a Firefox vulnerability: an attacker could perform an out-of-bounds read or write on a JavaScript object by fooling range-based bounds check elimination. Affected product: Mozilla Firefox versions earlier than 124.0.1 (desktop; ESR has separate fixes). The root cause is an incor...

CVE-2019-14834

CVE-2019-14834 affects dnsmasq prior to 2.81 and causes a memory leak that can be exploited remotely to trigger a denial of service via DHCP response creation. Public details across multiple advisories indicate the root cause is in memory management (e.g., create_helper function and related code ...

CVE-2023-24486

Citrix Workspace app for Linux is affected by a session takeover vulnerability (CVE-2023-24486) due to improper access control. An authenticated local user could gain access to another user’s Citrix Virtual Apps and Desktops session on the same machine when launching published desktops/applicatio...

CVE-2024-27028

CVE-2024-27028 is confirmed with concrete details in connected docs: the Linux kernel spi-mt65xx driver had a NULL pointer dereference in the interrupt handler during spi_transfer when tx_buf could be NULL. The fix adds a check for trans->tx_buf before use, mitigating potential crashes. Affect...

CVE-2023-29542

Technical details for CVE-2023-29542 are not publicly disclosed in the provided documents. No affected products, root cause, or mitigation are specified here. Monitor for updates from the sources to obtain concrete information.

CVE-2025-27516

CVE-2025-27516 : Jinja2 before 3.1.6 exposes a sandbox bypass via the |attr filter, allowing arbitrary Python code execution if an attacker controls template content. Affected: jinja2 versions prior to 3.1.6. Impact: execution of code in untrusted templates. Remediation: upgrade to 3.1.6 or newer...

CVE-2021-32804

The CVE-2021-32804 entry concerns the npm package tar (node-tar). Affected versions before 6.1.1, 5.0.6, 4.4.14, and 3.3.2 contain an arbitrary File Creation/Overwrite vulnerability caused by insufficient absolute path sanitization during extraction. node-tar attempts to prevent absolute paths by...

CVE-2021-25636

CVE-2021-25636 affects The Document Foundation LibreOffice 7.2.x prior to 7.2.5. The issue arises from an Improper Certificate Validation in which a document can be crafted so that the signature verification process uses KeyValue data while reporting a mismatch with X509Data, undermining trust in...

CVE-2021-31207

CVE-2021-31207 is one of the ProxyShell chain affecting on-premises Microsoft Exchange Server, enabling post-auth arbitrary-file-write that can lead to remote code execution. Exploitation chains documented in FireEye and related advisories describe initial steps using Autodiscover and MAPI to lea...

CVE-2011-1002

Avahi CVE-2011-1002 affects the avahi-daemon (avahi) before 0.6.29. A remote attacker can trigger a denial of service (infinite loop) by sending an empty mDNS UDP packet to port 5353 (IPv4 or IPv6). The issue arises from an incorrect fix related to CVE-2010-2244. Public advisories and distributio...

CVE-2019-10081

CVE-2019-10081 affects Apache httpd's HTTP/2 implementation (mod_http2) where very early pushes can overwrite memory in the pushing request’s pool, causing crashes. The vulnerable facet is the handling of push headers (not client data) and memory being copied from the configured push link header ...

CVE-2025-1386

CVE-2025-1386 concerns the ch-go library from github.com/ClickHouse/ch-go. The issue is a vulnerability in which, under a specific condition where a query includes large, uncompressed external data, an attacker who controls that data can smuggle another query packet into the same connection strea...

CVE-2021-3426

CVE-2021-3426 corresponds to a vulnerability in Python’s pydoc where the getfile feature could be abused to read arbitrary files. The linked sources confirm the issue affects Python versions prior to specific releases (e.g., Python before 3.8.9, 3.9.3, and 3.10.0a7 per the CVE description) and no...

CVE-2011-4448

CVE-2011-4448 affects WikkaWiki 1.3.1 and 1.3.2. The vulnerability is an SQL injection in actions/usersettings/usersettings.php via the default_comment_display parameter in an update action, caused by insufficient sanitization. This allows remote attackers to inject arbitrary SQL commands and pot...

CVE-2014-0050

This CVE affects Apache Commons FileUpload (MultipartStream.java) before version 1.3.1, as used in Apache Tomcat, JBoss Web, and other products. The root cause is a crafted Content-Type header that bypasses the loop exit conditions, allowing remote attackers to trigger an infinite loop and high C...

CVE-2021-3899

CVE-2021-3899 involves a race condition in Apport's replaced-executable detection that, with specific local configuration, could allow a local attacker to run arbitrary code as root. This vulnerability is referenced in multiple advisories (Ubuntu USN-6894-1, RH Red Hat CVE notes, and Nessus/OSV e...

CVE-2022-2569

This CVE (CVE-2022-2569) affects ARC Informatique PcVue (OAuth Web Service configuration) components: PcVue 12 (before 12.0.27) and PcVue 15 (before 15.2.3). The vulnerability stems from cleartext storage of sensitive information, potentially allowing an authenticated user to access session data ...

CVE-2024-57883

The CVE CVE-2024-57883 is a Linux kernel vulnerability in mm/hugetlb: independent PMD page table shared count. The root cause is an incorrect refcount increment in try_get_folio() that can be triggered by callers such as split_huge_pages, leading to a leaked PMD page table when the refcount is in...

CVE-2023-32373

CVE-2023-32373 is a use-after-free in WebKitGTK/WebKit related to processing malicious web content. Connected advisories confirm this vulnerability affects WebKitGTK/WebKit components and note exploitation activity. The issue is fixed in WebKitGTK/WebKit updates (e.g., webkitgtk4 packages) across...

CVE-2019-16935

The CVE-2019-16935 issue concerns the documentation XML-RPC server in Python (Lib/DocXMLRPCServer.py for Python 2.x and Lib/xmlrpc/server.py for Python 3.x). The root cause is that server_title, when set_server_title is called with untrusted input, can deliver arbitrary JavaScript to clients via ...

CVE-2021-25635

CVE-2021-25635 is a certificate-validation vulnerability in LibreOffice described as a Content Manipulation with Certificate Validation Attack. An attacker could enable self-signed ODF documents, then modify the signature algorithm to an invalid/unknown one; LibreOffice could display the signatur...

CVE-2025-26620

CVE-2025-26620 describes a race condition in Duende.AccessTokenManagement when multiple concurrent requests for client credentials tokens use varying TokenRequestParameters. The issue can cause concurrent requests to return tokens with incorrect protocol parameters (scope, resource indicator, etc...

CVE-2024-38475

CVE-2024-38475 affects Apache HTTP Server 2.4.59 and earlier, where improper escaping of output in mod_rewrite can map URLs to filesystem locations that are served but not directly reachable, enabling remote code execution or source code disclosure. The issue also involves substitutions in server...