CVE-2018-14040

CVE-2018-14040 affects Bootstrap prior to 4.1.2, where an XSS vulnerability exists in the collapse data-parent attribute. The root cause is HTML/script-injection via the collapse component’s data-parent handling. The vulnerability impacts Bootstrap-based implementations using collapse and can lea...

CVE-2013-4810

HP ProCurve Manager (PCM) 3.20/4.0, PCM+ 3.20/4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management are affected. The root cause is a remote code execution vector via a marshalled object to the EJBInvokerServlet or JMXInvokerServlet, enabling an attacker to execute arbitrar...

CVE-2025-26466

CVE-2025-26466 describes a DoS in OpenSSH where a malicious client floods ping/pong packets, causing unbounded memory growth on the server. Connected IBM AIX advisory notes affected OpenSSH filesets and provides concrete fixes: openssh.base.client/server at OpenSSH versions 9.7.3013.1000 (and 9.9...

CVE-2021-39226

Grafana CVE-2021-39226 describes a snapshot authentication bypass that allows viewing and deleting the lowest-key snapshot via literal paths. Affected: Grafana snapshot feature (unauthenticated and authenticated users can access /dashboard/snapshot/:key and /api/snapshots/:key to view the lowest-...

CVE-2018-8373

CVE-2018-8373 describes a remote code execution vulnerability in Internet Explorer due to how the scripting engine handles objects in memory. Affected software includes Internet Explorer 9, 10, and 11. The root cause is memory handling flaws in the scripting engine that can be triggered remotely ...

CVE-2012-1710

CVE-2012-1710 affects Oracle WebCenter Forms Recognition in Oracle Fusion Middleware 10.1.3.5. Multiple ActiveX components (CroProj.dll and Sssplt30.ocx) are vulnerable to directory-traversal flaws that can allow arbitrary file creation/overwrite when a user visits a crafted page. This enables re...

CVE-2023-0669

Fortra GoAnywhere MFT is affected by CVE-2023-0669, a pre-authentication deserialization vulnerability in the License Response Servlet that enables remote code execution by deserializing attacker-controlled objects. Exploitation and PoCs exist in public exploits/analyses; vendors patched the issu...

CVE-2020-25687

CVE-2020-25687 affects dnsmasq and is fixed in version 2.83. Affected component: DNSSEC-enabled processing in dnsmasq where a heap-based buffer overflow can occur. The root cause is insufficient length checks in rfc1035.c:extract_name() and related code paths in sort_rrset()/get_rdata(), enabling...

CVE-2019-5825

CVE-2019-5825 is a Google Chrome vulnerability in the V8 JavaScript engine: an out-of-bounds write that can enable remote heap corruption via a crafted HTML page. Affected software is Chrome (prior to 73.0.3683.86); the issue is tied to JavaScript execution/v8, leading to potential stability or m...

CVE-2018-15961

CVE-2018-15961 affects Adobe ColdFusion 2018 (July 12 release 2018.0.0.310739) and Update 6 and earlier, and Update 14 and earlier. The vulnerability is an unrestricted file upload via CKEditor (upload.cfm) that could allow remote attackers to upload arbitrary files and execute code on the affect...

CVE-2018-8406

CVE-2018-8406 is a DirectX Graphics Kernel (DXGKRNL) privilege-escalation vulnerability caused by the DXGKRNL driver improperly handling memory objects. Affected products include Windows Server 2016 and Windows 10 (and Windows 10 Servers). The CVE is characterized by a local, low-complexity attac...

CVE-2013-5065

NDProxy.sys in the Windows kernel is affected by a local privilege escalation flaw (CVE-2013-5065) caused by improper input validation in the NDPROXY driver. A crafted IOCTL path allows a local attacker to exploit a NULL pointer dereference to escalate privileges on affected systems. Public explo...

CVE-2025-24367

CVE-2025-24367 affects Cacti, an open-source monitoring framework. The flaw allows an authenticated Cacti user to abuse graph creation and graph template functionality to write arbitrary PHP scripts in the web root, leading to remote code execution on the server. Impact is remote code execution w...

CVE-2021-27852

CVE-2021-27852 concerns Checkbox Survey before version 7, where CheckboxWeb.dll deserializes untrusted _VSTATE data via LosFormatter in ASP.NET View State. The underlying issue allows an unauthenticated remote attacker to execute arbitrary code on the affected server, with the impact described as...

CVE-2020-0610

CVE-2020-0610 is a Windows RD Gateway vulnerability (BlueGate) that enables unauthenticated remote code execution over UDP/3391. The RD Gateway role with UDP transport enabled is affected; exploitation targets the gateway service via specially crafted UDP traffic, enabling full compromise (per th...

CVE-2015-3043

CVE-2015-3043 refers to a memory corruption vulnerability in Adobe Flash Player that allows remote code execution. Affected versions include Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows/macOS, and before 11.2.202.457 on Linux. The underlying root cause is desc...

CVE-2021-41357

CVE-2021-41357 is a Windows Win32k privilege-escalation vulnerability (local, low complexity, no user interaction) with CVSS v3.1 base score 7.8 (high). Affected component is Win32k; root cause involves elevation of privileges on Windows systems. Public disclosures in the connected documents indi...

CVE-2020-3566

CVE-2020-3566 affects Cisco IOS XR Software, exploiting the DVMRP feature via crafted IGMP traffic to exhaust device memory and disrupt processes. Root cause is insufficient IGMP queue management within DVMRP, potentially impacting interior/exterior routing protocols and causing instability. Mult...

CVE-2019-7195

CVE-2019-7195 is a QNAP Photo Station external file name/path control vulnerability. The CVE affects QNAP Photo Station on QTS with Photo Station versions prior to the fixes listed in QNAP NAS advisory NAS-201911-25 and related vendor advisories. The underlying issue is a path traversal/ improper...

CVE-2018-8405

Technical details (exploit vector, affected products/versions, root cause specifics, and mitigations) are not publicly disclosed in the provided connected documents. Monitor for updates from authoritative sources.

CVE-2017-17562

Embedthis GoAhead before 3.6.5 allows remote code execution when CGI is enabled and a CGI program is dynamically linked. The root cause is the initialization of the CGI environment from untrusted HTTP request parameters in cgi.c, enabling abuse via LD_PRELOAD and similar payloads posted to /proc/...

CVE-2017-5070

CVE-2017-5070 is a type confusion vulnerability in Google Chrome’s V8 engine that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Affected products include Google Chrome and other Chromium-based browsers (V8 engine), with desktop versions prior to 59...

CVE-2017-14493

CVE-2017-14493 is a stack-based buffer overflow in dnsmasq’s DHCPv6 handling. Remote attackers on the local network can send a crafted DHCPv6 request to trigger a crash or potentially execute arbitrary code. Public advisories confirm the issue and note a fix/update was released upstream in dnsmas...

CVE-2013-1331

CVE-2013-1331 is a buffer overflow in Microsoft Office 2003 SP3 and Office for Mac 2011 triggered when parsing PNG data embedded in an Office document, allowing remote attackers to execute arbitrary code. The vulnerability can be exploited through crafted PNG content, potentially via documents th...

CVE-2019-16920

CVE-2019-16920 is an unauthenticated remote code execution flaw in D-Link consumer routers (DIR-655C, DIR-866L, DIR-652, DHP-1565, DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, DIR-825, and others) triggered by arbitrary input to the PingTest CGI, allowing command injection and full system comp...

CVE-2010-5330

CVE-2010-5330 covers a command injection in Ubiquiti devices via GET to stainfo.cgi. The issue arises because the ifname parameter is not sanitized, enabling shell metacharacters to be injected. Affected families include Ubiquiti AirOS (before 4.0.1), AirMax ISP products (before 5.3.5), and AirSy...

CVE-2021-3737

CVE-2021-3737 is a vulnerability in Python’s HTTP client where an improperly handled HTTP response from a server could cause the client script to enter an infinite loop, leading to CPU-based DoS and affecting availability. The issue is documented across multiple advisories and packages (e.g., Pyt...

CVE-2020-5849

Summary (CVE-2020-5849) Unraid 6.8.0 contains an authentication bypass that can lead to remote code execution when exploited alongside the related issue (CVE-2020-5847). The Nessus plugin notes that Unraid

CVE-2019-1315

CVE-2019-1315 describes a local privilege-escalation in Windows Error Reporting Manager, triggered when hard links are mishandled. Affected: Windows OS components involving Error Reporting; root cause is improper handling leading to unauthorized file manipulation and elevation. CVSSv3.1 base scor...

CVE-2009-1151

CVE-2009-1151 affects phpMyAdmin 2.11.x (before 2.11.9.5) and 3.x (before 3.1.3.1). The flaw is a static code injection in setup.php that lets a remote attacker inject arbitrary PHP code into the generated configuration file via the save action. The issue arises from insufficient validation/misco...

CVE-2024-3852

The GetBoundName function in the JIT compiler could return the wrong version of an object when JIT optimizations are applied. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird

CVE-2021-27860

CVE-2021-27860 affects FatPipe WARP, IPVPN, and MPVPN web management interfaces. An unauthenticated remote attacker can upload arbitrary files to any location on the filesystem on affected devices running versions < 10.1.2r60p92 or

CVE-2020-6572

CVE-2020-6572 is a use-after-free in Chrome’s Media handling that could let a remote attacker run arbitrary code via a crafted HTML page, affecting Chrome desktop (pre-81.0.4044.92) and Android. The core issue is a use-after-free in Media components, with Android variant CVE-2020-6572 involving M...

CVE-2019-5591

CVE-2019-5591 in FortiOS is a default-configuration vulnerability that allows an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating an LDAP server, enabling man‑in‑the‑middle credential exposure. A PoC (GitHub: fortios-ldap-mitm-poc-CVE-2019-5591) demo...

CVE-2018-0167

CVE-2018-0167 involves multiple buffer overflow vulnerabilities in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, IOS XE Software, and IOS XR Software. The description documents that an unauthenticated, adjacent attacker could trigger a denial of service or escalate pri...

CVE-2022-37042

CVE-2022-37042 affects Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0. The vulnerability arises in the mboximport endpoint that accepts a ZIP archive; when an attacker bypasses authentication (no authtoken), they can upload arbitrary files, causing directory traversal and remote code execution. ...

CVE-2021-27059

CVE-2021-27059 is a Microsoft Office Remote Code Execution vulnerability with public advisories and multiple security updates. The provided documents indicate affected products include Office 2010, Office 2013, and Office 2016 (32/64‑bit), across multiple Service Packs. The root cause is not expl...

CVE-2021-27351

CVE-2021-27351 affects Telegram, specifically the Terminate Session feature, failing to invalidate a recently active session. Affected versions are Telegram for Android up to 7.2.1 and Telegram for Windows/UNIX up to 2.4.7. The issue is described as a failure to terminate active sessions, with no...

CVE-2013-1675

CVE-2013-1675 affects Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, and Thunderbird before 17.0.6. The issue arises from improper initialization of nsDOMSVGZoomEvent data structures (mPreviousScale and mNewScale), enabling a remote attacker to disclose memory-resident data via a cr...

CVE-2025-3277

SQLite CVE-2025-3277: An integer overflow in concat_ws() can cause a heap buffer overflow of ~4GB by using an untruncated original size to allocate and then write, potentially enabling arbitrary code execution. This is documented across multiple advisories (Debian, AlmaLinux, Fedora, AIX RPM advi...

CVE-2020-5847

Unraid 6.8.0 and earlier contains two CVEs: CVE-2020-5847 (remote code execution via insecure use of PHP extract) and CVE-2020-5849 (authentication bypass). Reports and exploit references (Metasploit module and Exploit-DB) confirm practical impact: authenticated admin access can be gained, then a...

CVE-2019-3929

CVE-2019-3929 is a remote, unauthenticated command-injection vulnerability exploitable via the file_transfer.cgi HTTP endpoint. Affected devices include Crestron AM-100 (firmware 1.6.0.2) and AM-101 (2.7.0.1); Barco wePresent WiPG-1000P (2.3.0.10) and WiPG-1600W prior to 2.4.1.19; Extron ShareLin...

CVE-2017-0222

CVE-2017-0222 and CVE-2017-0226 describe a remote code execution vulnerability in Microsoft’s Internet Explorer caused by improper access to memory objects. The root cause is memory corruption during object handling, leading to possible code execution in the current user context. CVSS data in the...

CVE-2021-32648

CVE-2021-32648 affects October CMS (Laravel-based) through the october/system package. An authentication bypass allows an attacker to request a password reset and then take over an account. Patches are available: Build 472 and v1.1.5. Public advisories and CVE trackers consistently describe this ...

CVE-2021-1906

CVE-2021-1906 affects Qualcomm Snapdragon GPU address management across Snapdragon Auto/Compute/Connectivity/Consumer IOT/Industrial IOT/Mobile/Wearables. Root cause: improper handling of address deregistration on failure can lead to a new GPU address allocation failure. CVSS reflects Medium seve...

CVE-2020-8193

CVE-2020-8193 affects Citrix ADC and Citrix Gateway (and Citrix SD-WAN WANOP) with unauthenticated access to certain endpoints due to improper access control. Affected releases include Citrix ADC/Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14, 10.5-70.18 and WAN-OP version...

CVE-2019-12384

CVE-2019-12384 affects FasterXML jackson-databind 2.x (pre-2.9.9.1) where failure to block logback-core in polymorphic deserialization can enable remote code execution depending on classpath contents. The Connected IBM documents corroborate broader jet deserialization gadget vulnerabilities in ja...

CVE-2022-24112

CVE-2022-24112 affects Apache APISIX. It arises from the batch-requests plugin, where a bug can bypass the Admin API IP restriction, enabling remote code execution. Exploits/PoCs exist for APISIX 2.12.0–2.12.1 demonstrating RCE via admin API path and Lua code injection in routes, with documented ...

CVE-2022-21965

Summary of CVE-2022-21965 (Microsoft Teams DoS) Affected product: Microsoft Teams. The vulnerability is a Denial of Service in Teams, with root details not fully disclosed in some sources but the CVE entry describes a DoS impact. According to CVSSv3.1, the base score is 7.5 (HIGH), with network a...

CVE-2021-22894

Pulse Connect Secure (PCS) is affected by CVE-2021-22894: a buffer overflow in Pulse Connect Secure Collaboration Suite prior to 9.1R11.4 can allow a remote authenticated user to execute arbitrary code as root via a maliciously crafted meeting room. The vulnerability has a high CVSS score (3.1): ...