CVE-2019-7238

CVE-2019-7238 affects Sonatype Nexus Repository Manager 3.x and is due to Incorrect Access Control that can enable remote code execution. Affected: Nexus Repository Manager before 3.15.0 (unauthenticated/or external access could trigger RCE). Documented exploitation exists in public artifacts (e....

CVE-2020-17144

CVE-2020-17144 is a deserialization vulnerability in Microsoft Exchange Server 2010 (MRM.AutoTag.Model) that can enable remote code execution. Public details from Attackerkb indicate exploitation requires authentication (e.g., via OWA EWS) and can execute OS commands with SYSTEM-level privileges;...

CVE-2021-44515

Zoho ManageEngine Desktop Central (and Desktop Central MSP) is affected by CVE-2021-44515, a authentication bypass that enables remote code execution on the server. Affected builds: Enterprise 10.1.2127.17 and earlier require upgrading to 10.1.2127.18; Enterprise 10.1.2128.0–10.1.2137.2 require 1...

CVE-2021-30883

CVE-2021-30883 is an memory-corruption vulnerability in Apple’s IOMobileFrameBuffer that can allow a malicious app to execute arbitrary code with kernel privileges. Apple patched it across iOS/iPadOS 14.8.1 and 15.0.2, macOS Big Sur 11.6.1 and Monterey 12.0.1, tvOS 15.1, and watchOS 8.1. The Appl...

CVE-2018-17480

CVE-2018-17480 is a Chrome/Chromium vulnerability in the V8 JavaScript engine: an out-of-bounds write that could enable remote code execution inside the sandbox via a crafted HTML page. Connected advisories confirm the impact across Chromium-based browsers and list the fixed-upstream version as 7...

CVE-2023-52465

CVE-2023-52465 concerns the Linux kernel where the power: supply component fixed a null pointer dereference in smb2_probe. The root cause involved devm_kasprintf and devm_kzalloc potentially returning NULL on allocation failure. The vulnerability is documented with a local attack vector and a hig...

CVE-2019-1132

CVE-2019-1132 affects Windows Win32k; the vulnerability arises from improper handling of memory objects in the Win32k subsystem, enabling local privilege escalation. In 2019 it was among Win32k 0-days observed in the wild and is listed in CISA’s Known Exploited Vulnerabilities Catalog as a Micros...

CVE-2019-9636

CVE-2019-9636 overview Python 2.7.x (up to 2.7.16) and Python 3.x (up to 3.7.2) are affected by improper handling of Unicode encoding during NFKC normalization, exposing information such as cookies and credentials cached for a hostname. The vulnerable components are urllib.parse.urlsplit and urll...

CVE-2016-10011

CVE-2016-10011 – OpenSSH sshd (OpenSSH before 7.4) : The vulnerability arises from how authfile.c handles realloc on buffer contents, potentially leaking host private key material to privilege-separated child processes. This is a local, privilege-edge case: an attacker with access to the privileg...

CVE-2011-0609

The CVE-2011-0609 issue is an Adobe Flash Player AVM Bytecode Verification vulnerability that allows remote code execution via crafted SWF content. Affected products include Flash Player 10.2.x and earlier (Windows, macOS, Linux, Solaris), Flash Player 10.1.106.16 and earlier on Android, Adobe AI...

CVE-2023-2868

CVE-2023-2868 affects Barracuda Email Security Gateway (ESG) Appliance versions 5.1.3.001–9.2.0.006. It is due to incomplete sanitization of a user-supplied .tar archive, enabling remote command execution via Perl's qx with the appliance privileges. Barracuda fixed it in patch BNSF-36456 (auto-ap...

CVE-2022-22047

CVE-2022-22047 is a Windows CSRSS Elevation of Privilege vulnerability. The CSRSS component may allow a local attacker who can execute code on the target to gain SYSTEM privileges. Public exploitation has been reported; Microsoft’s July 2022 Patch Tuesday addressed this family of issues (CSRSS Eo...

CVE-2019-0863

CVE-2019-0863 is a Windows Elevation of Privilege vulnerability in Windows Error Reporting (WER) where the vulnerability stems from the way WER handles files. The underlying issue allows local attackers to escalate to kernel-level privileges (CVE-2019-0863). Microsoft patched this in the May 2019...

CVE-2016-7255

CVE-2016-7255 is a Windows kernel privilege-escalation issue affecting win32k.sys. The CVE arises from a local attacker crafting an exploit against a Win32k component, enabling elevation to SYSTEM via the NtSetWindowLongPtr path in win32k.sys (MS16-135). Public exploitation materials in Exploit D...

CVE-2022-31129

Moment.js (JavaScript date library) contains a vulnerability in string-to-date parsing via RFC2822 parsing, causing quadratic (N^2) complexity and potential (Re)DoS for long inputs (>10k chars). The issue is mitigated by upgrading to Moment.js v2.29.4 or later; if upgrading is not possible, li...

CVE-2021-20022

CVE-2021-20022 affects SonicWall Email Security versions 10.0.9.x and enables post-authenticated arbitrary file upload via the branding ZIP mechanism (Zip Slip style) to write files to the server. FireEye/Mandiant detail that lack of input validation allows an attacker to place a web shell in a w...

CVE-2014-0130

CVE-2014-0130 describes a directory traversal in Ruby on Rails’ Action Pack (implicit_render path) affecting Rails 3.2.x before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1. A crafted request using wildcard route globbing can cause the application to read arbitrary local files via actionpac...

CVE-2013-1347

CVE-2013-1347 (Internet Explorer 8) is a remote code execution vulnerability in IE8 arising from a use-after-free in CGenericElement/mshtml.dll when handling in-memory objects. Exploitation in the wild during 2013 (notably DoL incident) demonstrated remote code execution by visiting a crafted web...

CVE-2012-4558

CVE-2012-4558 is an XSS vulnerability in Apache HTTP Server's balancer_handler (mod_proxy_balancer). Remote attackers can inject arbitrary web script/HTML via a crafted string in the manager interface for Apache 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4. Impact is arbitrary script execution ...

CVE-2010-0188

CVE-2010-0188 is an Adobe Reader/Acrobat vulnerability in the PDF handling stack (notably LibTIFF-related parsing) that could allow denial of service or remote code execution via a crafted PDF. Affected products include Adobe Reader/Acrobat 8.x (before 8.2.1) and 9.x (before 9.3.1). Public analys...

CVE-2009-3960

CVE-2009-3960 is an information-disclosure vulnerability in Adobe BlazeDS and related Adobe data services components (e.g., LiveCycle, ColdFusion) where XML External Entity/XML Injection flaws can allow remote attackers to obtain sensitive information. Root cause: injected tags and external entit...

CVE-2022-26143

Mitel MiCollab (TP-240) before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 contains a vulnerability in the TP-240 component that allows remote attackers to obtain sensitive information and trigger denial of service, including detrimental outbound traffic. The issue, known for enabling th...

CVE-2021-21017

CVE-2021-21017 affects Adobe Acrobat/Reader (DC Continuous and prior releases) with a heap-based buffer overflow that could allow arbitrary code execution in the user’s context after opening a malicious file. The linked exploit analyses describe a flaw in URL/baseURL handling within PDFs (potenti...

CVE-2020-27932

CVE-2020-27932 is a kernel-type-confusion issue in Apple’s XNU (mach turnstiles) that could allow a malicious app to execute code with kernel privileges. Connected sources confirm the root cause as a type confusion in kernel IPC machinery and note exploitation in-the-wild only in a macOS/iOS/macO...

CVE-2019-1385

CVE-2019-1385 is a local privilege-escalation vulnerability in Windows AppX Deployment Extensions (AppXSVC). The issue arises from improper privilege management within the AppX Deployment Extensions, enabling an authenticated attacker who runs a specially crafted application to elevate privileges...

CVE-2019-1253

CVE-2019-1253 describes a local privilege-escalation in Microsoft Windows AppX Deployment Server caused by improper handling of junctions. The vulnerability allows an attacker who already has code execution on the target system to elevate privileges (local attack, low integrity/login requirements...

CVE-2019-0752

CVE-2019-0752 is a remote code execution in Microsoft Internet Explorer caused by how the scripting engine handles memory objects, leading to memory corruption in IE10/IE11. Multiple connected sources confirm exploit presence (ZDI-19-359, Exploit-DB), and CISA lists it as a known exploited vulner...

CVE-2019-0797

CVE-2019-0797 is a Windows Win32k privilege-escalation vulnerability caused by the Win32k component failing to properly handle objects in memory, enabling local code execution with kernel privileges. Affected: Windows Win32k subsystem (Win32k.sys). Impact: elevated privileges to SYSTEM with poten...

CVE-2019-1003030

CVE-2019-1003030 describes a sandbox bypass in the Jenkins Pipeline: Groovy Plugin, affecting version 2.63 and earlier. The vulnerability arises in the plugin’s sandbox handling, specifically related to the CpsGroovyShell path, enabling an attacker who can control pipeline scripts to execute arbi...

CVE-2025-26522

The CVE-2025-26522 entry describes a flaw in the RupeeWeb trading platform where OTP validation is improperly implemented in certain API endpoints. The vulnerability can be exploited by a remote attacker who has valid credentials to manipulate API responses, potentially bypassing Two-Factor Authe...

CVE-2020-0938

CVE-2020-0938 affects the Windows Adobe Font Manager Library by improperly handling specially crafted multi-master Font 1 PostScript fonts. The root cause is a vulnerability in the font parser that can allow remote code execution when processing crafted documents. For all Windows versions except ...

CVE-2021-4102

CVE-2021-4102 is a use-after-free vulnerability in Google Chrome’s V8 engine. Affected component: V8 within Chrome prior to version 96.0.4664.110. Root cause: use-after-free that could enable heap corruption via a crafted HTML page. Impact: remote code execution with high severity (per CVSS metri...

CVE-2017-5753

CVE-2017-5753 is part of the Spectre family (Variant 1) described in the SPECTRE_MELTDOWN_ADVISORY: it involves speculative execution and a bounds-check bypass that can enable an unprivileged attacker to read privileged memory via cache timing analysis. IBM’s AIX/VIOS advisories and iFixes addres...

CVE-2013-0431

CVE-2013-0431 is an Oracle Java sandbox bypass in the JRE/OpenJDK stack affecting Java SE 7 up to Update 11 and OpenJDK 7, exploitable by a user‑assisted remote attacker via JMX‑related vectors. The vulnerability allows bypassing sandbox restrictions and is discussed alongside CVE-2013-1490 (dist...

CVE-2022-20700

CVE-2022-20700 affects Cisco Small Business RV160/RV260/RV340/RV345 Series Routers. The Cisco advisory (KA9PK6D) documents a set of vulnerabilities in the management interface and SSL VPN/firmware image verification that can enable arbitrary code execution, privilege escalation, arbitrary command...

CVE-2018-8440

CVE-2018-8440 is a Windows elevation-of-privilege flaw in ALPC handling, enabling local privilege escalation via the ALPC Task Scheduler interface. Public details in connected docs show exploit PoCs and proof-of-concept code exist (e.g., CANVAS and metasploit references) and that tested environme...

CVE-2024-21413

Summary of CVE-2024-21413 (Microsoft Outlook / Moniker Link): A vulnerability in Outlook where crafted Moniker Link URLs (often via file:///UNC paths) can trigger an automatic SMB access, potentially leaking the user’s NTLM hash to an attacker. Multiple PoCs on GitHub demonstrate delivering malic...

CVE-2023-32367

CVE-2023-32367: Apple documents an entitlement-related issue where an app may access user-sensitive data. The vulnerability is mitigated in iOS 16.5 and iPadOS 16.5, and macOS Ventura 13.4 (Patch/UPDATE_REQUIRED). No exploitation details are provided in the connected documents; remediation is to ...

CVE-2020-10987

CVE-2020-10987 affects the Tenda AC15/AC1900 router family (firmware 15.03.05.19 and earlier). The vulnerability resides in the goform/setUsbUnload endpoint, where an unauthenticated attacker can send a crafted deviceName POST parameter to remotely execute arbitrary system commands. Public source...

CVE-2019-0543

Technical details about CVE-2019-0543 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2012-6708

CVE-2012-6708 concerns jQuery. In versions before 1.9.0, the library’s jQuery(strInput) would treat inputs containing the character ‘<’ as HTML payloads, conflating HTML with selectors and enabling XSS via crafted strings. The underlying issue was that any input containing ‘<’ could be misi...

CVE-2011-4415

The CVE-2011-4415 issue affects the Apache HTTP Server (2.0.x up to 2.0.64 and 2.2.x up to 2.2.21) when mod_setenvif is enabled. The root cause is an integer overflow in ap_pregsub during environment variable handling (SetEnvIf), with a crafted .htaccess and HTTP header causing memory exhaustion ...

CVE-2024-3302

CVE-2024-3302 describes an unbounded processing of HTTP/2 CONTINUATION frames, enabling an Out of Memory condition in the browser. Affected: Firefox <125, Firefox ESR <115.10, Thunderbird

CVE-2020-5722

The Grandstream UCM6200 series (UCM62xx) is affected by CVE-2020-5722: an unauthenticated remote SQL injection via crafted HTTP requests in the HTTP interface, with potential to execute shell commands as root on versions before 1.0.19.20 and to inject HTML in password recovery emails on versions ...

CVE-2019-8605

CVE-2019-8605 is a use-after-free vulnerability in Apple’s XNU kernel (iOS, macOS, tvOS, watchOS) that could allow a malicious app to execute arbitrary code with system privileges. The initial description notes a use-after-free that was fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, and watc...

CVE-2018-18325

Summary: CVE-2018-18325 affects DNN (DotNetNuke) platforms running version 9.2 through 9.2.2. The issue is an inadequate encryption strength for input parameters, arising from an incomplete fix for CVE-2018-15811. The vulnerability is tied to the use of a weak encryption algorithm in protecting i...

CVE-2017-0005

Technical details (affected product/version, root cause, fix) are not provided in the supplied documents; public details are high-level. Monitor for updates from official advisories and CVE feeds.

CVE-2021-36742

CVE-2021-36742 is an improper input validation vulnerability that affects Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1. The root cause is flawed input validation that lets a local attacker escalate privileges after obtaining the ability to r...

CVE-2020-25506

Summary of vulnerability (CVE-2020-25506) : D-Link DNS-320 firmware v2.06B01 Revision Ax is vulnerable to a command-injection in the system_mgr.cgi component. The issue arises because the HTTP parameter f_ntp_server is not sanitized, enabling remote arbitrary command execution. The NUCLEI templat...

CVE-2021-3129

CVE-2021-3129 affects Laravel Ignition (and Laravel < 8.4.2) where insecure use of file_get_contents()/file_put_contents in debug mode allows unauthenticated RCE. Exploitable versions: Laravel Ignition < 2.5.2 and Laravel