CVE-2020-8816

CVE-2020-8816 : Pi-hole Web (AdminLTE) 4.3.2 is vulnerable to Remote Code Execution via a crafted DHCP static lease. Exploitation requires privileged dashboard access and is authenticated; the flaw arises from how DHCP static leases are processed, enabling an attacker with dashboard privileges to...

CVE-2016-0151

CVE-2016-0151 affects the Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 (Gold/R2), Windows RT 8.1, and Windows 10 (Gold/1511). The root cause is mismanagement of process tokens in CSRSS/in memory, enabling local privilege escalation via a crafted applicati...

CVE-2009-4324

Adobe Reader/Acrobat (Windows/macOS) is affected by CVE-2009-4324 due to a use-after-free in Doc.media.newPlayer inside Multimedia.api. A crafted PDF with ZLib streams can trigger remote code execution. The vulnerability is reported as exploited in the wild in December 2009. Affected versions inc...

CVE-2009-1862

CVE-2009-1862 describes a memory-corruption vulnerability in Adobe Flash Player (and Adobe Reader/Acrobat components) that can be triggered by specially crafted SWF content or a crafted PDF/Flash combo via authplay.dll, leading to remote code execution or memory corruption DoS. Affected products ...

CVE-2025-1385

The CVE-2025-1385 vulnerability affects ClickHouse when the library_bridge feature is enabled and exposes an HTTP API on localhost (default port 9019). This configuration allows the ClickHouse server to dynamically load a library from a path and execute it in an isolated process, which, combined ...

CVE-2024-3857

CVE-2024-3857 is a concrete Firefox/Thunderbird memory-safety issue caused by the JIT generating incorrect code for arguments, enabling use-after-free during GC. Affected: Firefox <125, Firefox ESR <115.10, Thunderbird

CVE-2022-31629

CVE-2022-31629 affects PHP cookie handling across multiple versions (pre-7.4.31, pre-8.0.24, pre-8.1.11). The Astra Linux security notes describe an insecure cookie bypass where a network/same-site attacker can set a cookie that PHP applications treat as __Host- or __Secure-; the issue ties to an...

CVE-2021-37415

CVE-2021-37415 affects Zoho ManageEngine ServiceDesk Plus. Before 11302, the product is vulnerable to an authentication bypass that allows access to a number of REST-API URLs without authentication. According to multiple sources, affected versions include 11.3 before 11302, 11.2 before 11208, 11....

CVE-2023-36802

CVE-2023-36802 is an Elevation of Privilege vulnerability in the Microsoft Streaming Service Proxy (MSKSSRV.SYS). The connected documents identify the root cause as an object type confusion in the Windows kernel-mode driver, enabling local privilege escalation to SYSTEM on vulnerable Windows 10/1...

CVE-2021-22941

CVE-2021-22941 affects Citrix ShareFile Storage Zones Controller prior to version 5.11.20 and is due to Improper Access Control. An unauthenticated attacker could remotely compromise the storage zones controller, with an endpoint exposure at /ShareFile/StorageCenter/Upload.aspx and potential for ...

CVE-2016-1646

Summary: CVE-2016-1646 affects Google Chrome’s V8 engine. The Array.prototype.concat implementation in V8/builtins.cc does not properly consider element data types, enabling a remote attacker to cause a denial of service (out-of-bounds read) via crafted JavaScript code. Affected software/versions...

CVE-2015-5119

The CVE-2015-5119 entry documents a use-after-free in Adobe Flash Player’s AS3 ByteArray class. The vulnerability arises when a crafted valueOf override in an object causes the ByteArray storage to be reallocated during a write ba[0] = obj, leading to memory corruption and potential remote code e...

CVE-2010-0840

CVE-2010-0840 is an unspecified vulnerability in the Java Runtime Environment within Oracle Java SE/Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 that can affect confidentiality, integrity, and availability via unknown vectors. The March 2010 CPU note references a possible issue with privileg...

CVE-2002-0367

CVE-2002-0367 affects Windows NT/2000 and involves the smss.exe debugging subsystem not properly authenticating connections to privileged processes. This allows a local attacker to gain Administrator or SYSTEM privileges by duplicating a handle to a privileged process. The vulnerability is charac...

CVE-2021-45382

CVE-2021-45382 affects D-Link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers. The vulnerability is a Remote Command Execution via the DDNS function in the ncc2 binary, allowing unauthenticated command execution and potentially full router compromise. The issue is described as a c...

CVE-2014-4404

CVE-2014-4404 describes a heap-based buffer overflow in IOHIDFamily that affects Apple iOS prior to 8 and Apple TV prior to 7. The vulnerability occurs when parsing crafted key-mapping properties, enabling an attacker to execute arbitrary code in a privileged context via a user-space application....

CVE-2020-10221

CVE-2020-10221 (rConfig) is a remote code execution vulnerability in the rConfig utility. Multiple connected sources confirm that lib/ajaxHandlers/ajaxAddTemplate.php contains an OS command injection flaw that allows an attacker to execute arbitrary OS commands, by injecting shell metacharacters ...

CVE-2017-5030

CVE-2017-5030 is a memory corruption vulnerability in Google Chrome’s V8 engine. A remote attacker could execute arbitrary code via a crafted HTML page. Affected portion is V8 in Chromium/Chrome; remediation is upgrade to Chromium/Chrome version 57.0.2987.98 or newer (upstream fix referenced by A...

CVE-2016-6935

Adobe Creative Cloud Desktop on Windows is affected by CVE-2016-6935 due to an unquoted Windows search path in versions prior to 3.8.0.310, enabling local privilege escalation via a Trojan horse executable placed in the SYSTEMDRIVE root. The advisory APSB16-34 recommends updating to 3.8.0.310 to ...

CVE-2021-22017

Summary of CVE-2021-22017 : VMware vCenter Server’s rhttp proxy (rhttproxy) has an improper URI normalization implementation that can be exploited by a remote attacker with network access to port 443 to bypass proxy restrictions and access internal endpoints. The vulnerability affects vCenter Ser...

CVE-2020-1956

Apache Kylin CVE-2020-1956 affects 2.3.0 and releases up to 2.6.5 and 3.0.1, where REST APIs concatenate user input into OS commands, enabling likely remote code execution with high impact. Connected documents confirm vulnerable versions and the underlying command injection in the REST layer; som...

CVE-2020-36775

CVE-2020-36775 affects the Linux kernel’s f2fs subsystem. The vulnerability was tied to a potential deadlock in the f2fs_write_compressed_pages() path, mitigated by using f2fs_trylock_op() (consistent with the approach used in f2fs_write_single_data_page()) to avoid deadlocks. The concrete fix is...

CVE-2023-34062

CVE-2023-34062 affects Reactor Netty HTTP Server. Versions 1.1.x prior to 1.1.13 and 1.0.x prior to 1.0.39 are vulnerable when the server is configured to serve static resources. A crafted URL can trigger a directory traversal (path traversal) vulnerability, allowing access to restricted files. T...

CVE-2023-20867

Summary: CVE-2023-20867 affects open-vm-tools (VMware Tools) with an authentication bypass in the vgauth module, enabling a fully compromised ESXi host to disrupt host-to-guest authentication and impact guest VM confidentiality and integrity. The issue is exploitable with root access on ESXi (loc...

CVE-2019-15271

Cisco CVE-2019-15271 affects Small Business RV Series routers (RV016, RV042, RV042G, RV082). The issue is due to insufficient input validation of the HTTP payload in the web-based management interface, allowing an authenticated remote attacker with valid credentials or an active session token to ...

CVE-2018-5002

CVE-2018-5002 affects Adobe Flash Player, up to version 29.0.0.171, with a stack-based buffer overflow that could allow arbitrary code execution in the context of the current user. Connected advisories indicate a remediation upgrade to Flash Player 30.0.0.113 (or newer) to fix this issue, and som...

CVE-2018-1302

Apache HTTP Server (httpd) before 2.4.30 may write a NULL pointer to freed memory when an HTTP/2 stream is destroyed after handling. This is described as low risk and hard to trigger in standard configurations, with no reproducibility outside debug builds. Affected releases include older 2.4.x li...

CVE-2017-6738

Cisco IOS and IOS XE SNMP subsystem contains multiple buffer overflow vulnerabilities that could allow an authenticated, remote attacker to execute arbitrary code or cause a reload via crafted SNMP packets over IPv4/IPv6. Affected are SNMP versions 1–3; for SNMPv2c/earlier, attacker needs the rea...

CVE-2016-1010

CVE-2016-1010 is an integer overflow vulnerability in Adobe Flash Player and Adobe AIR stack. Affected: Flash Player before 18.0.0.333 and 19.x–21.x before 21.0.0.182 on Windows/macOS; Flash before 11.2.202.577 on Linux; Adobe AIR before 21.0.0.176 and AIR SDK/Compiler before 21.0.0.176. Cause: i...

CVE-2011-0611

CVE-2011-0611 affects Adobe Flash Player before 10.2.154.27 (Windows/macOS/Linux/Solaris) and 10.2.156.12 and earlier on Android, plus Authplay.dll in Reader/Acrobat components. The vulnerability allows remote attackers to execute arbitrary code or cause a denial of service via crafted Flash cont...

CVE-2023-1370

The CVE-2023-1370 entry concerns Netplex Json-smart, a JSON processing library. Public materials in the connected docs confirm a stack-exhaustion (DoS) due to unbounded nesting when parsing nested arrays/objects in JSON input, caused by recursive parsing. Affected version range is 2.5.0 through 2...

CVE-2021-36783

CVE-2021-36783 (Rancher info-disclosure) affects SUSE Rancher where credentials, passwords and API tokens stored in cleartext are exposed via API endpoints to authenticated users (Cluster Owners/Members, Project Owners/Members). Affected: Rancher versions before 2.6.4 (and 2.5.x before 2.5.13). R...

CVE-2022-22577

CVE-2022-22577 describes an XSS vulnerability in Rails’ Action Pack with the claim of bypassing CSP for non-HTML responses. The Initial and connected documents consistently reference this issue in Action Pack (Rails component) and cite multiple advisories (e.g., Debian DSA-5372, Rocky/RLSA adviso...

CVE-2019-15949

Nagios XI

CVE-2004-0210

CVE-2004-0210 describes a local privilege escalation in the Windows POSIX subsystem affecting Windows NT 4.0 and Windows 2000. The vulnerability is a buffer overflow caused by unchecked message length handling in the POSIX subsystem, enabling a local authenticated user to gain full system privile...

CVE-2024-4368

CVE-2024-4368 affects Chromium/Chrome where Dawn use-after-free can lead to heap corruption via a crafted HTML page. The issue is fixed in Chromium 124.0.6367.118 and newer per multiple advisories (e.g., Debian DSA-5676-1 and Fedora/chromium updates); update Chromium/Chrome to the patched version...

CVE-2019-8394

Zoho ManageEngine SDP

CVE-2015-8651

CVE-2015-8651 is an Adobe Flash Player vulnerability described as an integer overflow that enables remote code execution. The initial entry lists affected Flash Player versions on Windows, OS X, and Linux, and notes exploitation to run arbitrary code via unspecified vectors. Connected sources con...

CVE-2006-2660

Summary: CVE-2006-2660 is a buffer/path length vulnerability in PHP’s tempnam() related to long pathnames. Affected versions: PHP 5.1.4 and PHP 4.x prior to 4.4.3. Impact (as stated): Local users can bypass restrictions and create PHP files with fixed names in other directories due to MAXPATHLEN–...

CVE-2021-25298

CVE-2021-25298 affects Nagios XI up to version 5.7.5, with an authenticated OS command-injection in /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php caused by improper sanitization of user-controlled input via a single HTTP request. The vulnerability can enable remote cod...

CVE-2017-12237

CVE-2017-12237 affects Cisco IOS (15.0–15.6) and IOS XE (3.5–16.5) with ISAKMP enabled. The IKEv2 module is vulnerable to unauthenticated remote probes via specific IKEv2 packets, allowing high CPU utilization, traceback messages, or device reloads that cause DoS. Affected devices need ISAKMP to ...

CVE-2017-6740

CVE-2017-6740 describes multiple SNMP remote code execution vulnerabilities in Cisco IOS and IOS XE, due to a buffer overflow in the SNMP subsystem. An authenticated, remote attacker could exploit crafted SNMP packets (over IPv4/IPv6) to execute arbitrary code or cause a reload. Exploitation for ...

CVE-2026-15917

Drupal core 11.2 and above integrates the HTMX JavaScript library , and the built-in XSS filter does not sufficiently sanitize certain HTMX attributes, allowing a cross-site scripting (XSS) attack. An attacker must be able to insert HTML with specific attributes to exploit this. Affected versions...

CVE-2024-12224

Public technical specifics for CVE-2024-12224 (affected components, root cause, remediation) are not present in the connected documents; monitor for updates.

CVE-2020-1631

CVE-2020-1631 is a path traversal/LFI vulnerability in the HTTP/HTTPS J-Web service of Junos OS. An unauthenticated attacker can exploit HTTP(S) to perform local file inclusion, path traversal, or possibly inject commands into httpd.log, read files with world-readable permissions (notably configu...

CVE-2018-8298

CVE-2018-8298 – ChakraCore RCE vulnerability exists in the ChakraCore scripting engine, arising from how memory objects are handled. A remote code execution flaw is described, affecting ChakraCore (and related Microsoft scripting environments per linked advisories). The issue is categorized as a ...

CVE-2015-2419

CVE-2015-2419 is a JScript 9 vulnerability in Microsoft Internet Explorer (IE10/IE11) that allows remote code execution and memory corruption when processing crafted JSON with JSON.stringify. The CVE is exploited via malicious web content and has been leveraged by loaders in exploit kits (notably...

CVE-2008-0655

CVE-2008-0655 affects Adobe Acrobat/Reader (before 8.1.2). Connected advisories confirm multiple vulnerabilities in Adobe Reader/Acrobat, including JS API DOC.print could silently trigger printing, and PDF processing flaws that could enable arbitrary code execution. Red Hat RHSA-2008:0144 documen...

CVE-2026-55805

CVE-2026-55805 is a Stored Cross-Site Scripting (XSS) vulnerability in Drupal core , caused by the Layout Builder module failing to sufficiently sanitize block labels in certain scenarios. An attacker can inject malicious scripts that are later executed in the browser of another user. Exploitatio...

CVE-2022-32221

CVE-2022-32221 concerns curl/libcurl where the read callback (CURLOPT_READFUNCTION) may be used for POST data even after a PUT if the same handle was used for a PUT with that callback. This can cause sending the wrong data or memory errors on a subsequent POST. Connected advisories note this affe...