CVE-2015-1701

CVE-2015-1701 is a Win32k.sys kernel-mode privilege-escalation flaw affecting Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2. The issue stems from improper handling within win32k, notably around the ClientCopyImage/SetWindowLongPtr path, enabling a crafted user-mode input to execute code...

CVE-2020-17049

CVE-2020-17049 is a Kerberos KDC service-ticket delegation bypass in IBM Application Gateway, enabling a compromised service using Kerberos Constrained Delegation to tamper with service tickets and force KDC acceptance. The vulnerability affects IBM Application Gateway versions 19.12–24.06. IBM’s...

CVE-2020-14864

CVE-2020-14864 affects Oracle BI Enterprise Edition (OBIEE) under the Fusion Middleware Installation component. A Directory Traversal/Local File Inclusion in the getPreviewImage function lets an authenticated attacker with access to the admin interface read arbitrary system files via the previewF...

CVE-2019-0808

Technical details (affected software, vulnerable component, root cause, impact, fixes) are not provided in the connected documents. Please monitor for updates from official advisories.

CVE-2022-20791

CVE-2022-20791 affects Cisco Unified Communications Manager (CUCM), Unified CM SME, and Unified CM IM&P. Root cause: insufficient file permission restrictions that allow an authenticated remote attacker to read arbitrary files on the underlying OS by sending a crafted command via the application ...

CVE-2022-22434

IBM Robotic Process Automation (RPA) versions 21.0.1 and 21.0.2 are affected by CVE-2022-22434, where a user with physical access can modify an API request to create additional objects. The IBM security bulletin lists remediation: upgrade to 21.0.1.6 for 21.0.1 and 21.0.2.3 for 21.0.2; RPA as a S...

CVE-2018-0173

CVE-2018-0173 affects Cisco IOS Software and Cisco IOS XE Software. The issue is incomplete input validation of encapsulated DHCPv4 option 82 information, processed when handling DHCPOFFER responses forwarded to DHCP servers. A crafted DHCPv4 packet can trigger an error in processing the option 8...

CVE-2017-12232

Cisco ISR G2 routers running Cisco IOS 15.0–15.6 are affected by CVE-2017-12232 due to a misclassification of Ethernet frames, which allows an unauthenticated adjacent attacker to cause a reload and a DoS condition by sending a crafted Ethernet frame. The vulnerability impact is a denial of servi...

CVE-2017-6334

CVE-2017-6334 affects NETGEAR DGN2200 routers (firmware up to 10.0.0.50). The vulnerability is a command-injection in dnslookup.cgi, exploitable by remote authenticated users via shell metacharacters in the host_name field of an HTTP POST, enabling arbitrary OS command execution. Related entries ...

CVE-2023-36479

What is affected. Jetty’s CGI Servlet (org.eclipse.jetty.servlets.CGI) in Jetty versions impacted by CVE-2023-36479. Root cause. When a request targets a binary with a space in its name, Jetty escapes the command by wrapping it in quotes; if the binary name contains a quotation mark followed by a...

CVE-2018-0174

CVE-2018-0174 affects Cisco IOS/IOS XE DHCP option 82 encapsulation. The issue is incomplete input validation of DHCPv4 option 82 data received from DHCP relay agents, allowing an unauthenticated, remote attacker to cause an affected device to reload and trigger a DoS. The connected documents con...

CVE-2017-6627

CVE-2017-6627 affects Cisco IOS 15.1/15.2/15.4 and IOS XE 3.14–3.18. A UDP processing code issue leaves UDP sockets idle, allowing unauthenticated remote attackers to send UDP packets (dest port 0) that fill the input interface queue, wedge an interface queue, and cause DoS. The input queue repor...

CVE-2009-3953

CVE-2009-3953 affects Adobe Reader/Acrobat U3D handling in PDFs. The vulnerability arises from a CLODProgressiveMeshDeclaration array boundary issue in the U3D implementation, allowing remote code execution when processing malformed U3D data. Affected product versions include Acrobat/Reader 9.x p...

CVE-2021-21300

Summary: CVE-2021-21300 affects Git when cloning into case-insensitive file systems and using certain clean/smudge filters (e.g., Git LFS). A specially crafted repository containing symbolic links and files processed by these filters can cause an unchecked script to run during checkout. Affected ...

CVE-2016-11021

The CVE-2016-11021 entry concerns D-Link DCS-930L devices with version 2.12 and earlier. The vulnerability arises from a flaw in the setSystemCommand handling, allowing a remote attacker to execute arbitrary OS commands via the SystemCommand parameter. The Red Hat, CISA KEV, CVE records and PT-Se...

CVE-2012-1535

Adobe Flash Player suffers an arbitrary code execution/DoS vulnerability (CVE-2012-1535) via crafted SWF content. Expected impact is remote code execution or application crash; evidence cites in-the-wild activity in August 2012. Affected versions are Windows/Mac OS X: prior to 11.3.300.271; Linux...

CVE-2011-2462

Adobe Reader/Acrobat U3D memory corruption vulnerability (CVE-2011-2462) affects Adobe Reader X (10.1.1) and earlier on Windows/macOS; Adobe Reader 9.x up to 9.4.6 on Windows, macOS, UNIX; exploitation could allow remote code execution or DoS via crafted U3D content. The issue is in the U3D parse...

CVE-2022-21176

CVE-2022-21176 affects Airspan/Mimosa MMP and related C-series and A5x device versions: improper input sanitization leads to SQL injection and potential exposure of sensitive data. Affected versions: MMP < 1.0.3; PTP C-series < 2.8.6.1; PTMP C-series/A5x

CVE-2018-19949

CVE-2018-19949 is a remote command-injection vulnerability in QNAP QTS File Station. Multiple connected sources confirm that, if exploited, remote attackers could run arbitrary commands, with a high-severity impact (NVD CVSS v3.1: CRITICAL, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). QNAP has issued fi...

CVE-2018-8414

CVE-2018-8414 is a Windows Shell remote code execution vulnerability where the Windows Shell fails to validate file paths. If a user opens a specially crafted file, an attacker could run arbitrary code in the user’s context. The vulnerability affects Windows 10 and related shells. Microsoft relea...

CVE-2015-2419

CVE-2015-2419 is a JScript 9 vulnerability in Microsoft Internet Explorer (IE10/IE11) that allows remote code execution and memory corruption when processing crafted JSON with JSON.stringify. The CVE is exploited via malicious web content and has been leveraged by loaders in exploit kits (notably...

CVE-2015-3113

CVE-2015-3113 is a heap-based buffer overflow in Adobe Flash Player affecting Windows/macOS Flash parsing of FLV data, exploited in the wild in June 2015. Affected versions: Flash Player before 13.0.0.296, and 14.x up to 18.x before 18.0.0.194 on Windows/macOS; before 11.2.202.468 on Linux. The f...

CVE-2023-20269

Cisco ASA/FTD remote access VPN vulnerability CVE-2023-20269 allows an unauthenticated, remote attacker to perform brute force against credentials or, for older releases (

CVE-2019-2616

CVE-2019-2616 affects Oracle Fusion Middleware’s BI Publisher/XML Publisher in versions 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 . It is a XML External Entity (XXE) injection in the BI Publisher Security subcomponent, allowing an unauthenticated, network-accessible attacker (via HTTP) to read server da...

CVE-2017-12233

Summary: CVE-2017-12233 affects Cisco IOS (versions 12.4–15.6) where CIP (Common Industrial Protocol) packets are improperly parsed. The root cause is insufficient input handling for CIP requests, allowing an unauthenticated, remote attacker to cause an affected device to reload, producing a deni...

CVE-2015-7645

CVE-2015-7645 is an Adobe Flash Player remote code execution vulnerability exploitable via a crafted SWF file. The initial document states Flash Player 18.x–18.0.0.252 and 19.x–19.0.0.207 on Windows and macOS, and 11.x–11.2.202.535 on Linux, with exploitation observed in the wild in October 2015....

CVE-2006-2492

CVE-2006-2492 is a buffer overflow in Microsoft Word (Office 2000 SP3, XP SP3, 2003 SP1/SP2) and Microsoft Works through 2006 caused by a malformed object pointer. The flaw allows arbitrary code execution and requires user interaction (via opening a crafted Word/Works document). Affected products...

CVE-2025-69690

Netgate pfSense Community Edition 2.7.2 and 2.8.0 are affected by two authenticated RCE paths. First, unsafe deserialization in the module installer/backups allows a crafted backup XML containing a serialized PHP object with the post_reboot_commands property to execute commands with root privileg...

CVE-2023-44446

CVE-2023-44446 affects GStreamer’s MXF demuxer (gstreamer1-plugins-bad-free, among others). The vulnerability is a use-after-free during MXF file parsing caused by not validating an object’s existence before operating on it. This can allow an attacker to execute code in the context of the affecte...

CVE-2009-4324

Adobe Reader/Acrobat (Windows/macOS) is affected by CVE-2009-4324 due to a use-after-free in Doc.media.newPlayer inside Multimedia.api. A crafted PDF with ZLib streams can trigger remote code execution. The vulnerability is reported as exploited in the wild in December 2009. Affected versions inc...

CVE-2008-0655

CVE-2008-0655 affects Adobe Acrobat/Reader (before 8.1.2). Connected advisories confirm multiple vulnerabilities in Adobe Reader/Acrobat, including JS API DOC.print could silently trigger printing, and PDF processing flaws that could enable arbitrary code execution. Red Hat RHSA-2008:0144 documen...

CVE-2020-24557

CVE-2020-24557 affects Trend Micro Apex One, OfficeScan, and Worry‑Free Business Security on Windows. The issue is an improper access control that allows an attacker who can run low‑privilege code to manipulate a protected product folder, disable security temporarily, abuse a Windows function, an...

CVE-2019-9948

CVE-2019-9948 involves urllib in Python 2.x (up to 2.7.16) and urllib in Python 3.x up to 3.7.4, where the local_file: scheme can bypass blacklist protections, enabling remote attackers to trigger local_file:///… URIs (e.g., /etc/passwd) and bypass URL-filtering. Public advisories from Debian, Re...

CVE-2015-1130

CVE-2015-1130 affects Apple OS X, specifically the XPC implementation in the Admin Framework, before 10.10.3. It allows local users to bypass authentication and obtain admin privileges via unspecified vectors. Exploitation has been demonstrated (e.g., ROOTPIPE/Rootpipe PoC and Metasploit/CANVAS r...

CVE-2013-0074

CVE-2013-0074 (Microsoft Silverlight) affects Silverlight 5 and the 5 Developer Runtime prior to 5.1.20125.0. The root cause is improper validation of pointers during HTML object rendering, leading to a pointer-dereference memory corruption that can allow remote code execution via a crafted Silve...

CVE-2021-27562

CVE-2021-27562 affects Arm Trusted Firmware M through 1.2; the NS world can trigger a system halt, overwrite secure data, or print secure data via NSPE handler mode. CVSS indicates low–medium overall risk (LOCAL, LOW IT, HIGH availability impact). Public sources confirm details across NVD, CISA K...

CVE-2017-6077

CVE-2017-6077 affects NETGEAR DGN2200 routers (firmware up to 10.0.0.50). The vulnerability is a remote code execution via ping.cgi: an authenticated attacker can inject shell metacharacters in the ping_IPAddr field of an HTTP POST, enabling arbitrary OS command execution. The issue is tied to th...

CVE-2016-4655

CVE-2016-4655 is an iOS kernel information-disclosure vulnerability that allowed memory disclosure via a crafted app on affected iOS versions (pre-9.3.5). The connected docs include PoC exploit references (Trident for iOS

CVE-2016-0162

CVE-2016-0162 affects Microsoft Internet Explorer 9–11. The vulnerability is an information disclosure flaw: crafted JavaScript can cause IE to reveal the existence of local files, enabling an attacker to detect specific files on a user’s system. Impact is limited to information disclosure (not c...

CVE-2016-0984

CVE-2016-0984 is a use-after-free vulnerability in Adobe Flash Player (and related AIR components) that enables arbitrary code execution. Affected products include Flash Player Windows/macOS (before 18.0.0.329 and 19.x prior to 20.0.0.306) and Linux (before 11.2.202.569), as well as Adobe AIR bef...

CVE-2015-1770

CVE-2015-1770 affects Microsoft Office 2013 SP1 and Office 2013 RT SP1, via uninitialized memory use in Office components when processing crafted Office documents, enabling remote code execution. The vulnerability’s impact is high (CVE/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) with network vector and ...

CVE-2024-50379

CVE-2024-50379 is a TOCTOU race condition in JSP compilation on Apache Tomcat that can lead to RCE when the default servlet is writable on case-insensitive file systems. Affected lines include Tomcat 11.0.0-M1–11.0.1, 10.1.0-M1–10.1.33, and 9.0.0.M1–9.0.97 (also some older EOL versions). The issu...

CVE-2023-40217

CVE-2023-40217 affects Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. The issue occurs mainly in TLS client-auth scenarios on servers (e.g., HTTP servers). If a TLS server-side SSLSocket is created, data is read into the socket buffer and the socket is...

CVE-2018-11138

CVE-2018-11138 affects Quest KACE System Management Appliance 8.0.318 where the unauthenticated /common/download_agent_installer.php endpoint can be abused to execute arbitrary commands as the web server user. The Core Security advisory and multiple sources confirm remote code execution via unaut...

CVE-2022-20747

The CVE-2022-20747 concern is Cisco SD-WAN vManage Software Information Disclosure via the History API. Root cause: insufficient API authorization checks on the underlying OS, enabling an authenticated, lower-privileged user to access sensitive information. Affected component: History API in Cisc...

CVE-2021-27561

CVE-2021-27561 affects Yealink Device Management (DM) platform, specifically DM 3.6.0.20. The vulnerability enables pre-auth, unauthenticated remote command execution via the URI /sm/api/v1/firewall/zone/services, yielding root access and high-severity impact (CVSS v3.1: 9.8, CRITICAL). The conne...

CVE-2018-5002

CVE-2018-5002 affects Adobe Flash Player, up to version 29.0.0.171, with a stack-based buffer overflow that could allow arbitrary code execution in the context of the current user. Connected advisories indicate a remediation upgrade to Flash Player 30.0.0.113 (or newer) to fix this issue, and som...

CVE-2011-2005

CVE-2011-2005 : Afd.sys in the Microsoft Windows XP (SP2/SP3) and Server 2003 (SP2) Ancillary Function Driver fails to properly validate user‑mode input before passing to kernel mode, enabling local privilege escalation. Exploitation climbs from a crafted user‑mode application to SYSTEM privilege...

CVE-2022-3437

CVE-2022-3437 is a heap-based buffer overflow in Samba’s use of Heimdal GSSAPI (unwrap_des/unwrap_des3). The fix involved making memcmp constant-time and patching a compiler-related issue by adding “!= 0” to memcmp results; backported patches were applied to heimdal-7.7.1 and 7.8.0 branches (and ...

CVE-2021-23874

CVE-2021-23874 affects McAfee Total Protection (MTP) versions prior to 16.0.30. The vulnerability is an Arbitrary Process Execution leading to local privilege escalation and code execution by a local user, bypassing MTP self-defense. Affected component: MTP privilege management; root cause: impro...