CVE-2021-30713

CVE-2021-30713 affects macOS Big Sur 11.4 and concerns the TCC (Transparency, Consent, and Control) subsystem. The vulnerability is described as a permissions issue that could allow a malicious application to bypass Privacy preferences, with the fix implemented in Big Sur 11.4. Related sources co...

CVE-2016-3088

CVE-2016-3088 affects Apache ActiveMQ 5.x prior to 5.14.0. The Fileserver web application vulnerable to remote code execution via an HTTP PUT followed by an HTTP MOVE request allows an attacker to upload and execute arbitrary files on the server. Connected PoC repositories describe Python-based a...

CVE-2023-5869

CVE-2023-5869 (PostgreSQL) : A flaw in PostgreSQL enables authenticated database users to execute arbitrary code via missing overflow checks during SQL array value modification, caused by an integer overflow when modifying arrays. The described impact includes arbitrary write/read of memory and p...

CVE-2020-36193

CVE-2020-36193 affects PHP’s PEAR Archive_Tar (Archive_Tar) up to version 1.4.11. The root cause is inadequate checking of symbolic links, enabling directory traversal for write operations inside an archive. This is a related issue to CVE-2020-28948. Mitigation: upgrade Archive_Tar to 1.4.14 or l...

CVE-2023-52454

CVE-2023-52454 affects the Linux kernel nvmet-tcp path. A host sending an H2CData command with an invalid DATAL can cause a kernel panic or a NULL pointer dereference in nvmet_tcp_build_pdu_iovec(), as evidenced by the crash trace in nvmet_tcp_io_work. The fix raises a fatal error when DATAL is n...

CVE-2019-18348

CVE-2019-18348 affects Python’s urllib/urllib2 handling of URL parameters. The issue allows CRLF injection when an attacker controls a url parameter, notably in the host component of a URL, enabling injection of HTTP headers. Public details in connected advisories confirm the vulnerability and ci...

CVE-2014-3120

CVE-2014-3120 : Elasticsearch’s default configuration prior to certain builds enables dynamic scripting, allowing remote attackers to execute arbitrary MVEL expressions and Java code via the _search source parameter. Public references indicate this enables remote code execution and constitutes a ...

CVE-2021-30869

CVE-2021-30869 is a type confusion vulnerability in Apple’s XNU kernel that may allow a malicious application to execute arbitrary code with kernel privileges. The issue affects iOS/iPadOS and macOS (XNU IPC-related code) and was observed in-the-wild in conjunction with WebKit-related flaws; expl...

CVE-2019-0803

CVE-2019-0803 is a Windows Win32k elevation of privilege vulnerability. Root cause: Win32k fails to properly handle objects in memory, enabling local kernel-mode code execution. Affected software: Microsoft Windows Win32k component (privilege escalation). Impact: local privilege escalation with k...

CVE-2018-1303

CVE-2018-1303: An out-of-bounds read in mod_cache_socache could crash the Apache HTTP Server prior to 2.4.30, enabling a DoS against users of httpd. The issue is discussed across multiple advisories (Debian/ALT Linux/Arch Linux security notes and CentOS RH advisories) and is attributed to imprope...

CVE-2023-21036

The CVE-2023-21036 issue affects Google Pixel devices' Markup tool (BitmapExport.java) where a logic error prevents proper truncation of image data after edits, potentially leaving remnants of the original image in cropped/edited PNGs. Public sources (NVD/NVD entry, CVE lists) describe a local, p...

CVE-2021-41182

CVE-2021-41182 is an XSS in the jQuery-UI Datepicker altField path (embedded in some OTRS deployments). Affected version observed as 1.12.1 copy; the issue is fixed in jQuery UI 1.13.0 by treating any altField value as a CSS selector. Debris from related CVEs (41183/41184) describe similar issues...

CVE-2021-27103

The CVE-2021-27103 issue affects Accellion FTA prior to FTA_9_12_416, where SSRF is triggered by a crafted POST to wmProgressstat.html. The connected documents provide concrete context: (1) vulnerability stems from server-side request forgery in the Accellion FTA web interface, (2) remediation is...

CVE-2019-0585

CVE-2019-0585 is a remote code execution vulnerability in Microsoft Word/Office products caused by improper handling of objects in memory. Exploitation could occur via specially crafted Word files, potentially in contexts like email/preview panes, with the attacker gaining the same user rights as...

CVE-2010-5326

The CVE-2010-5326 issue affects SAP NetWeaver Application Server Java, specifically the Invoker Servlet, and is exploitable without authentication. Affected are SAP NetWeaver AS Java platforms possibly older than version 7.3, where an unauthenticated HTTP/HTTPS request can trigger remote code exe...

CVE-2011-3368

CVE-2011-3368 affects the Apache HTTP Server’s mod_proxy in reverse-proxy configurations. The vulnerability arises when using (1) RewriteRule with the [P] flag or (2) ProxyPassMatch; a remote attacker can craft a URI starting with an initial @ character to force the proxy to connect to an interna...

CVE-2021-28799

CVE-2021-28799 is an improper authorization vulnerability affecting QNAP HBS 3 on various QTS/QuTS versions. The flaw allows remote attackers to log in to affected devices. Affected: HBS 3 on QTS 4.5.2 (prior to v16.0.0415); QTS 4.3.6 (prior to v3.0.210412); QTS 4.3.4 (prior to v3.0.210411); QTS ...

CVE-2019-12900

CVE-2019-12900 affects bzip2 up to 1.0.6. The vulnerability is an out-of-bounds write in BZ2_decompress (decompress.c) when there are many selectors, potentially causing memory corruption. Public notices list multiple vendor advisories (e.g., Rocky Linux/AlmaLinux, Debian/Ubuntu, OpenSUSE, Amazon...

CVE-2024-34459

The CVE-2024-34459 issue affects libxml2’s xmllint when using --htmlout, where a formatting error in error messages can trigger a buffer over-read in xmlHTMLPrintFileContext. The vulnerability concerns xmllint and the libxml2 parser before versions 2.11.8 and 2.12.x before 2.12.7. A PoC exists pe...

CVE-2023-42859

CVE-2023-42859 affects macOS where an app may modify protected parts of the file system. Root cause details aren’t explicitly provided beyond this risk. The issue is fixed in macOS Sonoma 14.1 and also addressed in macOS Monterey 12.7.1 and macOS Ventura 13.6.1. CVSS context among sources indicat...

CVE-2012-0151

CVE-2012-0151 : A vulnerability in the Windows Authenticode Signature Verification (WinVerifyTrust) function (affecting Windows XP SP2/XP SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2/R2, Windows 7 SP1, and Windows 8 Consumer Preview) fails to properly validate the dige...

CVE-2023-28782

Described vulnerability CVE-2023-28782 affects Gravity Forms WordPress plugin versions

CVE-2022-21703

CVE-2022-21703 is a Grafana Cross-Site Request Forgery (CSRF) vulnerability that can enable privilege escalation by tricking an authenticated high-privilege user into inviting the attacker as a new user with high privileges. Affected software is Grafana (versions from >= 3.0-beta1; as per advi...

CVE-2021-33766

Technical details about CVE-2021-33766 are not publicly provided in the supplied documents. Monitor for updates from the referenced advisories; additional specifics (affected versions, exploitability, and fixes) are not available here.

CVE-2021-28664

CVE-2021-28664 concerns the Arm Mali GPU kernel driver, enabling privilege escalation or memory corruption (unprivileged user can write to read-only memory). Affected GPU families and revisions: Bifrost r0p0–r29p0 (before r30p0), Valhall r19p0–r29p0 (before r30p0), and Midgard r8p0–r30p0 (before ...

CVE-2020-3541

CVE-2020-3541 affects Cisco Webex on Windows (Webex Meetings Client/Desktop App/Teams). The root cause is unsafe logging of authentication requests, allowing an authenticated, local attacker to read log files in the application directory and access sensitive information. Impact is information dis...

CVE-2018-17463

CVE-2018-17463 is a remote code execution vulnerability in the V8 JavaScript engine used by Google Chrome/Chromium. The issue allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page, stemming from an incorrect side-effect annotation in V8. Public disc...

CVE-2013-2423

CVE-2013-2423 is an unspecified remote vulnerability in the Java Runtime Environment (JRE) component affecting Oracle Java SE 7 (Update 17 and earlier) and OpenJDK 7. The root cause, as per connected advisories, involves hotspot-related code and unknown vectors allowing reflection/type-confusion ...

CVE-2022-20703

CVE-2022-20703 applies to Cisco Small Business RV160, RV260, RV340 and RV345 Series Routers. The issue is a trust/verification weakness in the software image loading process that can allow an unauthenticated attacker to install and boot a malicious or unsigned image, enabling possible arbitrary c...

CVE-2019-1458

CVE-2019-1458 is a Windows Win32k elevation-of-privilege flaw affecting win32k.sys. The root cause is an uninitialized field in the server window dispatch table (gpsi->mpFnid_serverCBWndProc[FNID_SWITCH]), which leaves extraWnd data improperly sized. This allows an attacker to write arbitrary ...

CVE-2021-37976

CVE-2021-37976 is a Google Chrome information-disclosure vulnerability described as an information leak in the core memory component that could allow a remote attacker to obtain potentially sensitive data from process memory via a crafted HTML page. The issue affected Chrome pre-94.0.4606.71; a f...

CVE-2020-16010

CVE-2020-16010 is a Google Chrome for Android UI heap buffer overflow vulnerability that allowed remote code execution and potential sandbox escape when a renderer process was compromised. Affected component: Chrome UI on Android prior to 86.0.4240.185. Root cause: heap buffer overflow in UI hand...

CVE-2023-52463

CVE-2023-52463 affects the Linux kernel efivarfs: when SetVariable support is missing at runtime, the code remounts efivarfs RO but fails to validate remount flags, allowing a NULL or improper access leading to a crash. The issue is demonstrated by remounting /sys/firmware/efi/efivars RW and issu...

CVE-2021-30633

CVE-2021-30633 is a use-after-free in the Indexed DB API of the Chromium-based Google Chrome browser, leading to potential sandbox escape when a renderer process is compromised. Affected software is Google Chrome (Chromium engine) prior to version 93.0.4577.82. The issue arises in the Indexed DB ...

CVE-2019-9023

CVE-2019-9023 affects PHP mbstring: heap-based buffer over-read when regcomp/regexec/regparse in mbstring are fed invalid multibyte data. Affected versions include PHP 5.6.40 and PHP 7.x prior to 7.1.26 (7.1.x), 7.2.x prior to 7.2.14, and 7.3.x prior to 7.3.1. Root cause is memory read outside al...

CVE-2017-9120

CVE-2017-9120 affects PHP 7.x through 7.1.5, due to an Integer overflow in mysqli_real_escape_string that can trigger a denial of service (buffer overflow and application crash). The connected documents confirm this root cause and impact across multiple advisories and listings (e.g., CVE-2017-912...

CVE-2021-44521

CVE-2021-44521 affects Apache Cassandra when enable_user_defined_functions: true, enable_scripted_user_defined_functions: true, and enable_user_defined_functions_threads: false. The documented unsafe configuration can allow an attacker with cluster-level permissions to create user-defined functio...

CVE-2017-8291

Summary of CVE-2017-8291 (Ghostscript Type Confusion) : Ghostscript before or on 2017-04-26 allowed bypass of -dSAFER and remote command execution through a type confusion in parsing .eps/.rsdparams, specifically involving the substring "/OutputFile (%pipe%" in a crafted EPS input. In the wild ex...

CVE-2024-26604

CVE-2024-26604 concerns the Linux kernel. The issue arises from reverting the change that removed redundant NULL checks for ktype in kobject handling. The description and connected docs indicate this revert was done because of reported problems, and there is no publicly provided fix or patch deta...

CVE-2023-37450

CVE-2023-37450 is a WebKit/WebKitGTK-related vulnerability where processing web content may lead to arbitrary code execution. Apple’s documentation states the issue was addressed with improved checks and memory handling, with fixes in iOS 16.6 / iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventur...

CVE-2021-38648

CVE-2021-38648 is a local privilege-escalation flaw in Microsoft Open Management Infrastructure (OMI). Multiple sources confirm an authentication bypass allowing a local attacker to issue commands to the OMI socket (default UNIX socket at /var/opt/omi/run/omiserver.sock) and execute as root. The ...

CVE-2019-1064

CVE-2019-1064 is a Windows elevation-of-privilege flaw in the AppXSVC (Windows AppX Deployment Service) due to improper handling of hard links. The root cause allows a locally authenticated attacker to run processes in an elevated context, potentially installing programs or modifying data. Micros...

CVE-2019-9193

The CVE-2019-9193 entry concerns PostgreSQL 9.3–11.2 where the COPY TO/FROM PROGRAM functionality allows superusers or members of the pg_execute_server_program role to run arbitrary OS commands as the database server OS user. This behavior is enabled by default and can enable command execution on...

CVE-2010-2861

Adobe ColdFusion

CVE-2010-1428

CVE-2010-1428 affects Red Hat JBoss Enterprise Application Platform (JBEAP) Web Console, where access control was enforced only for GET/POST; other methods allowed unauthorized access to sensitive information. Affected versions are JBEAP 4.2 up to 4.2.0.CP08/4.3 up to 4.3.0.CP07 (per initial desc...

CVE-2021-38000

CVE-2021-38000 is an insufficient validation vulnerability in the Intents component of the Chromium/Google Chrome engine prior to 95.0.4638.69. A remote attacker could cause a user to be navigated to a malicious URL via a crafted HTML page. The issue is listed across multiple advisories (Arch Lin...

CVE-2012-3152

CVE-2012-3152/3153 affect Oracle Fusion Middleware’s Oracle Reports Developer component (11.1.1.4, 11.1.1.6, 11.1.2.0). An unspecified vulnerability in the Report Server/Servlet can allow remote attackers to affect confidentiality and integrity; one note indicates possible file read/upload of a ....

CVE-2012-4969

The CVE-2012-4969 issue is a use-after-free in the CMshtmlEd::Exec function of mshtml.dll used by Microsoft Internet Explorer (IE6–IE9 according to the CVE payload). Exploitation enabled remote code execution via a crafted website; the vulnerability was observed in the wild around September 2012....

CVE-2025-2492

CVE-2025-2492 affects ASUS AiCloud on supported routers and describes an improper authentication control that can be triggered by a crafted request, potentially allowing remote execution of functions with administrative privileges. Core details from connected sources indicate a high-severity (CVS...

CVE-2020-0069

The CVE-2020-0069 issue affects MediaTek CMDQ driver ioctl handlers in Android kernel, where insufficient input sanitization and missing SELinux restrictions can cause an out-of-bounds write, enabling local privilege escalation without extra privileges or user interaction. Public material confirm...