CVE-2002-0370

CVE-2002-0370 refers to a buffer overflow/unchecked buffer in ZIP decompression in Windows ZIP handling affecting Windows 98 with Plus! Pack, XP, ME, Lotus Notes R4–R6, Verity KeyView, and StuffIt Expander before 7.0. OpenVAS and Nessus entries corroborate the MS02-054 fix. The vulnerability can ...

CVE-2021-40870

Summary (CVE-2021-40870) : Aviatrix Controller 6.x before 6.5-1804.1922 is affected by an unrestricted file upload via a directory traversal flaw that enables an unauthenticated attacker to execute arbitrary code. The base vulnerability is described in the primary CVE record, which lists the affe...

CVE-2013-1675

CVE-2013-1675 affects Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, and Thunderbird before 17.0.6. The issue arises from improper initialization of nsDOMSVGZoomEvent data structures (mPreviousScale and mNewScale), enabling a remote attacker to disclose memory-resident data via a cr...

CVE-2023-26360

Adobe ColdFusion CVE-2023-26360 is an Improper Access Control vulnerability that could enable arbitrary code execution in the context of the current user. Affected products include ColdFusion 2018 Update 15 and earlier and ColdFusion 2021 Update 5 and earlier; exploitation does not require user i...

CVE-2020-16013

CVE-2020-16013 concerns the Chromium V8 engine used by Google Chrome prior to 86.0.4240.198, where an inappropriate implementation could allow a remote attacker to trigger heap corruption via a crafted HTML page. Affected software is Chromium-based Chrome builds up to version 86.0.4240.198 (inclu...

CVE-2020-8816

CVE-2020-8816 : Pi-hole Web (AdminLTE) 4.3.2 is vulnerable to Remote Code Execution via a crafted DHCP static lease. Exploitation requires privileged dashboard access and is authenticated; the flaw arises from how DHCP static leases are processed, enabling an attacker with dashboard privileges to...

CVE-2018-8405

Technical details (exploit vector, affected products/versions, root cause specifics, and mitigations) are not publicly disclosed in the provided connected documents. Monitor for updates from authoritative sources.

CVE-2017-0222

CVE-2017-0222 and CVE-2017-0226 describe a remote code execution vulnerability in Microsoft’s Internet Explorer caused by improper access to memory objects. The root cause is memory corruption during object handling, leading to possible code execution in the current user context. CVSS data in the...

CVE-2016-6277

CVE-2016-6277 affects Netgear routers (R6250, R6400, R6700, R6900, R7000, R7100LG, R7300DST, R7900, R8000, D6220, D6400, D7000, and possibly others) where remote attackers could execute arbitrary commands via shell metacharacters in the path info to cgi-bin/. Root cause is unsanitized/crafted pat...

CVE-2026-48908

CVE-2026-48908 affects the Joomla extension SP Page Builder (com_sppagebuilder). Reports and PoCs confirm unauthenticated file upload via the asset.uploadCustomIcon task, allowing arbitrary files to be written to the webroot and potentially executing PHP code. Affected versions are 1.0.0 through ...

CVE-2020-3161

The CVE-2020-3161 issue affects the web server used by Cisco IP Phones, where improper input validation of HTTP requests can allow an unauthenticated, remote attacker to execute code with root privileges or trigger a reload, causing a DoS. The vulnerability is tied to input validation flaws in th...

CVE-2010-5330

CVE-2010-5330 covers a command injection in Ubiquiti devices via GET to stainfo.cgi. The issue arises because the ifname parameter is not sanitized, enabling shell metacharacters to be injected. Affected families include Ubiquiti AirOS (before 4.0.1), AirMax ISP products (before 5.3.5), and AirSy...

CVE-2018-20058

CVE-2018-20058 describes a local file path traversal in Evernote for macOS prior to 7.6, affecting the attachment preview feature (MACOSNOTE-28634). The vulnerability path is local file access via the attachment preview, enabling potential leakage of files present on the user’s system. The NVD en...

CVE-2018-0161

The CVE-2018-0161 issue is a Cisco IOS/IOS XE SNMP vulnerability affecting Cisco Catalyst switches (e.g., 2960-L series and related Digital Building Series switches) where an authenticated SNMP GET for the ciscoFlashMIB OID can trigger a DoS and restart the device (SYS-3-CPUHOG). Root cause is a ...

CVE-2021-1906

CVE-2021-1906 affects Qualcomm Snapdragon GPU address management across Snapdragon Auto/Compute/Connectivity/Consumer IOT/Industrial IOT/Mobile/Wearables. Root cause: improper handling of address deregistration on failure can lead to a new GPU address allocation failure. CVSS reflects Medium seve...

CVE-2021-22991

CVE-2021-22991 affects BIG-IP Traffic Management Microkernel (TMM) URI normalization, where undisclosed requests to a virtual server may trigger a buffer overflow in TMM. This can cause a DoS and, in some scenarios, bypass URL-based access controls or enable remote code execution. The issue impac...

CVE-2017-5070

CVE-2017-5070 is a type confusion vulnerability in Google Chrome’s V8 engine that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Affected products include Google Chrome and other Chromium-based browsers (V8 engine), with desktop versions prior to 59...

CVE-2023-21705

CVE-2023-21705 is a Microsoft SQL Server remote code execution vulnerability. Public documents indicate the issue is addressed in security updates for SQL Server 2019 GDR (KB5021125) which fixes multiple CVEs including CVE-2023-21705; the update targets SQL Server 2019 and brings the product to b...

CVE-2020-7071

CVE-2020-7071 affects PHP: the FILTER_VALIDATE_URL path could treat a URL with invalid userinfo (username:password) as valid. Affected: PHP 7.3.x < 7.3.26, 7.4.x

CVE-2020-0638

CVE-2020-0638 is a Windows Update Notification Manager elevation-of-privilege vulnerability. An attacker who already has code execution on the target could exploit the flaw by running a crafted program to elevate privileges, due to how the Update Notification Manager handles files. The issue is l...

CVE-2018-0167

CVE-2018-0167 involves multiple buffer overflow vulnerabilities in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, IOS XE Software, and IOS XR Software. The description documents that an unauthenticated, adjacent attacker could trigger a denial of service or escalate pri...

CVE-2015-3043

CVE-2015-3043 refers to a memory corruption vulnerability in Adobe Flash Player that allows remote code execution. Affected versions include Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows/macOS, and before 11.2.202.457 on Linux. The underlying root cause is desc...

CVE-2020-36775

CVE-2020-36775 affects the Linux kernel’s f2fs subsystem. The vulnerability was tied to a potential deadlock in the f2fs_write_compressed_pages() path, mitigated by using f2fs_trylock_op() (consistent with the approach used in f2fs_write_single_data_page()) to avoid deadlocks. The concrete fix is...

CVE-2022-29217

CVE-2022-29217 affects the Python PyJWT library (jwt handling for RFC 7519). The root cause is algorithm confusion when decoding tokens if the application does not restrict accepted algorithms; allowing unintended verification behavior across signing algorithms. The issue is mitigated by upgradin...

CVE-2022-23134

The CVE-2022-23134 entry details an authentication/authorization issue in Zabbix Frontend: after initial setup, some setup.php steps are accessible by unauthenticated users, potentially allowing bypass of checks and changes to frontend configuration. Connected advisories confirm real-world impact...

CVE-2021-22941

CVE-2021-22941 affects Citrix ShareFile Storage Zones Controller prior to version 5.11.20 and is due to Improper Access Control. An unauthenticated attacker could remotely compromise the storage zones controller, with an endpoint exposure at /ShareFile/StorageCenter/Upload.aspx and potential for ...

CVE-2021-27852

CVE-2021-27852 concerns Checkbox Survey before version 7, where CheckboxWeb.dll deserializes untrusted _VSTATE data via LosFormatter in ASP.NET View State. The underlying issue allows an unauthenticated remote attacker to execute arbitrary code on the affected server, with the impact described as...

CVE-2018-1302

Apache HTTP Server (httpd) before 2.4.30 may write a NULL pointer to freed memory when an HTTP/2 stream is destroyed after handling. This is described as low risk and hard to trigger in standard configurations, with no reproducibility outside debug builds. Affected releases include older 2.4.x li...

CVE-2013-0629

CVE-2013-0629 is an Adobe ColdFusion directory traversal vulnerability affecting ColdFusion 9.0, 9.0.1, 9.0.2, and 10 when a password is not configured. It allows an attacker to access restricted directories via unspecified vectors and was exploited in the wild in January 2013. Connected sources ...

CVE-2022-32917

CVE-2022-32917 is a kernel-level remote code execution risk in Apple OSes addressed by fixes that implement improved bounds checks. Affected: macOS Big Sur 11.7, macOS Monterey 12.6, iOS 15.7, iPadOS 15.7, iOS 16. The issue allowed an application to execute arbitrary code with kernel privileges a...

CVE-2020-11261

CVE-2020-11261 is a memory-corruption vulnerability in Qualcomm Snapdragon chipsets (including Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice & Music, Wearables). Root cause: improper check when an application requests memory allocation for an extremely large ...

CVE-2019-3010

CVE-2019-3010 affects Oracle Solaris with the XScreenSaver component. A local privilege-escalation vulnerability exists in xscreensaver since version 5.06 on unpatched Solaris 11; a user with local logon can escalate privileges to root, potentially compromising the system. Public references descr...

CVE-2005-2700

This CVE concerns the Apache mod_ssl module (ssl_engine_kernel.c) where configuring SSLVerifyClient optional at global vhost level fails to enforce SSLVerifyClient require in per-location contexts. Attackers could bypass intended access restrictions by omitting a client certificate. Affected comp...

CVE-2020-27930

CVE-2020-27930 is a memory corruption vulnerability in font parsing that can lead to arbitrary code execution when processing a malicious font. Affected Apple software includes macOS Big Sur 11.0.1, iOS 14.2, iPadOS 14.2, watchOS 7.1, and corresponding Security Updates (e.g., High Sierra/Mojave)....

CVE-2020-9818

CVE-2020-9818 describes an out‑of‑bounds write in the Mail component of Apple iOS/iPadOS/watchOS. Affected versions: iOS 13.5 and iPadOS 13.5, iOS 12.4.7, and watchOS 6.2.5. Root cause: improved bounds checking in handling of malicious mail messages may prevent memory corruption. Impact as stated...

CVE-2019-0903

Technical details about CVE-2019-0903 (affected component/version/root cause/impact) are not publicly provided in the supplied documents. Monitor for updates.

CVE-2013-3897

CVE-2013-3897 is a use-after-free vulnerability in the CDisplayPointer class of mshtml.dll used by Microsoft Internet Explorer (IE6–IE11). The flaw is triggered via crafted JavaScript using the onpropertychange event, leading to remote code execution or memory corruption. Public discussions and r...

CVE-2024-4368

CVE-2024-4368 affects Chromium/Chrome where Dawn use-after-free can lead to heap corruption via a crafted HTML page. The issue is fixed in Chromium 124.0.6367.118 and newer per multiple advisories (e.g., Debian DSA-5676-1 and Fedora/chromium updates); update Chromium/Chrome to the patched version...

CVE-2023-36802

CVE-2023-36802 is an Elevation of Privilege vulnerability in the Microsoft Streaming Service Proxy (MSKSSRV.SYS). The connected documents identify the root cause as an object type confusion in the Windows kernel-mode driver, enabling local privilege escalation to SYSTEM on vulnerable Windows 10/1...

CVE-2022-24112

CVE-2022-24112 affects Apache APISIX. It arises from the batch-requests plugin, where a bug can bypass the Admin API IP restriction, enabling remote code execution. Exploits/PoCs exist for APISIX 2.12.0–2.12.1 demonstrating RCE via admin API path and Lua code injection in routes, with documented ...

CVE-2017-16138

CVE-2017-16138 affects the mime Node.js module, with vulnerable versions including

CVE-2010-4345

CVE-2010-4345 is a local privilege escalation in Exim up to version 4.72, where the exim user could gain root privileges by specifying an alternate configuration file with -C or via macro overrides (-D). Upstream fixes require changes to Exim behavior; newer builds drop root privileges when run w...

CVE-2024-12224

Public technical specifics for CVE-2024-12224 (affected components, root cause, remediation) are not present in the connected documents; monitor for updates.

CVE-2024-3859

CVE-2024-3859: Mozilla Firefox and Thunderbird are affected by a 32-bit integer overflow that can cause an out-of-bounds read via a malformed OpenType font. Affected products per the CVE entry: Firefox < 125, Firefox ESR < 115.10, and Thunderbird

CVE-2021-39226

Grafana CVE-2021-39226 describes a snapshot authentication bypass that allows viewing and deleting the lowest-key snapshot via literal paths. Affected: Grafana snapshot feature (unauthenticated and authenticated users can access /dashboard/snapshot/:key and /api/snapshots/:key to view the lowest-...

CVE-2019-11048

CVE-2019-11048 affects PHP mainline releases where HTTP file uploads are allowed: PHP 7.2.x below 7.2.31, 7.3.x below 7.3.18, and 7.4.x below 7.4.6. The flaw allows overly long filenames or field names to trigger memory allocation that exceeds limits, causing the engine to stop processing and fai...

CVE-2012-5519

CVE-2012-5519 affects the Common UNIX Printing System (CUPS) 1.4.4 and earlier on Linux distros (e.g., Debian). The web interface stores the administrator key in /var/run/cups/certs/0 with permissions that allow lpadmin users to read/write files, enabling local privilege escalation to root via th...

CVE-2009-3960

CVE-2009-3960 is an information-disclosure vulnerability in Adobe BlazeDS and related Adobe data services components (e.g., LiveCycle, ColdFusion) where XML External Entity/XML Injection flaws can allow remote attackers to obtain sensitive information. Root cause: injected tags and external entit...

CVE-2022-42889

CVE-2022-42889 affects Apache Commons Text 1.5–1.9 where default interpolation lookups (script, dns, url) can trigger arbitrary code execution or remote access when untrusted values are used. The vulnerability can lead to remote code execution or unintended contact with remote servers via the Str...

CVE-2022-31629

CVE-2022-31629 affects PHP cookie handling across multiple versions (pre-7.4.31, pre-8.0.24, pre-8.1.11). The Astra Linux security notes describe an insecure cookie bypass where a network/same-site attacker can set a cookie that PHP applications treat as __Host- or __Secure-; the issue ties to an...