CVE-2012-1535

Adobe Flash Player suffers an arbitrary code execution/DoS vulnerability (CVE-2012-1535) via crafted SWF content. Expected impact is remote code execution or application crash; evidence cites in-the-wild activity in August 2012. Affected versions are Windows/Mac OS X: prior to 11.3.300.271; Linux...

CVE-2018-11138

CVE-2018-11138 affects Quest KACE System Management Appliance 8.0.318 where the unauthenticated /common/download_agent_installer.php endpoint can be abused to execute arbitrary commands as the web server user. The Core Security advisory and multiple sources confirm remote code execution via unaut...

CVE-2017-12233

Summary: CVE-2017-12233 affects Cisco IOS (versions 12.4–15.6) where CIP (Common Industrial Protocol) packets are improperly parsed. The root cause is insufficient input handling for CIP requests, allowing an unauthenticated, remote attacker to cause an affected device to reload, producing a deni...

CVE-2005-2700

This CVE concerns the Apache mod_ssl module (ssl_engine_kernel.c) where configuring SSLVerifyClient optional at global vhost level fails to enforce SSLVerifyClient require in per-location contexts. Attackers could bypass intended access restrictions by omitting a client certificate. Affected comp...

CVE-2026-9277

CVE-2026-9277 affects the shell-quote library: the quote() function did not validate object-token shapes against the parser’s operator model, allowing line terminators in the .op field to bypass escaping and potentially enable command injection. Exploitation paths include direct construction of {...

CVE-2024-29857

CVE-2024-29857 (open vulnerability in Bouncy Castle family). An issue in ECCurve.java/ECCurve.cs can allow an EC certificate with crafted F2m parameters to trigger excessive CPU usage while evaluating curve parameters. Affected products/versions include BC Java before 1.78, BC Java LTS before 2.7...

CVE-2019-11048

CVE-2019-11048 affects PHP mainline releases where HTTP file uploads are allowed: PHP 7.2.x below 7.2.31, 7.3.x below 7.3.18, and 7.4.x below 7.4.6. The flaw allows overly long filenames or field names to trigger memory allocation that exceeds limits, causing the engine to stop processing and fai...

CVE-2009-3129

CVE-2009-3129 concerns a remote-code-execution vulnerability in Microsoft Office Excel and related components caused by a FEATHEADER record with an invalid cbHdrData size that affects a pointer offset. Affected products include Excel 2002 SP3, 2003 SP3, 2007 SP1/SP2, Open XML File Format Converte...

CVE-2019-2616

CVE-2019-2616 affects Oracle Fusion Middleware’s BI Publisher/XML Publisher in versions 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 . It is a XML External Entity (XXE) injection in the BI Publisher Security subcomponent, allowing an unauthenticated, network-accessible attacker (via HTTP) to read server da...

CVE-2015-0313

Adobe Flash Player is affected by a use-after-free vulnerability (CVE-2015-0313) that enables remote code execution via crafted SWF handling. Affected products include Flash Player versions prior to 13.0.0.269 and 14.x–16.x prior to 16.0.0.305 on Windows/macOS, and prior to 11.2.202.442 on Linux....

CVE-2016-0162

CVE-2016-0162 affects Microsoft Internet Explorer 9–11. The vulnerability is an information disclosure flaw: crafted JavaScript can cause IE to reveal the existence of local files, enabling an attacker to detect specific files on a user’s system. Impact is limited to information disclosure (not c...

CVE-2015-1770

CVE-2015-1770 affects Microsoft Office 2013 SP1 and Office 2013 RT SP1, via uninitialized memory use in Office components when processing crafted Office documents, enabling remote code execution. The vulnerability’s impact is high (CVE/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) with network vector and ...

CVE-2026-40175

CVE-2026-40175 : The Axios library is affected by a prototype-pollution vulnerability in a third-party dependency, which can lead to injection of unsanitized header values into outbound requests. The NVD description specifies vulnerable versions as prior to 1.15.0 and 0.3.1, with a fix in those v...

CVE-2022-31676

Summary: CVE-2022-31676 affects VMware Tools / open-vm-tools (versions including 12.0.0, 11.x.y, 10.x.y). A local non-administrative guest OS user can escalate privileges to root inside the VM. Root cause / impact: Local privilege escalation within the guest VM as described in multiple security a...

CVE-2022-29499

The CVE-2022-29499 vulnerability affects the Service Appliance component in Mitel MiVoice Connect (SA 100, SA 400, Virtual SA) through 19.2 SP3, due to incorrect data validation that enables remote code execution. Impact is documented as Remote Code Execution with high/severe CVSS scores (up to 9...

CVE-2020-24557

CVE-2020-24557 affects Trend Micro Apex One, OfficeScan, and Worry‑Free Business Security on Windows. The issue is an improper access control that allows an attacker who can run low‑privilege code to manipulate a protected product folder, disable security temporarily, abuse a Windows function, an...

CVE-2018-0125

CVE-2018-0125 affects Cisco RV132W/RV134W routers. The web interface suffers from incomplete input validation in HTTP requests, allowing an unauthenticated attacker to execute arbitrary code with root privileges or trigger a device reload (DoS). Affected products: RV132W ADSL2+ Wireless-N VPN Rou...

CVE-2015-2425

Technical details about CVE-2015-2425 are not publicly available in the provided connected documents. Current sources confirm IE11 memory corruption remote code execution vector, but specifics (affected versions, root cause, fixes) are not disclosed here. Monitor for updates.

CVE-2026-59310

CVE-2026-59310 is a VMware vCenter directory-traversal vulnerability in the Syslog server that, with network access, could allow an attacker to execute arbitrary code. The connected documents confirm: (1) root cause is directory traversal in the Syslog service, enabling code execution on vulnerab...

CVE-2022-26691

CVE-2022-26691 is a privilege-escalation issue in the CUPS printing system caused by a logic error in local authorization. Connected documentation shows affected packages across multiple distributions and versions, with patches released: e.g., cups

CVE-2021-27561

CVE-2021-27561 affects Yealink Device Management (DM) platform, specifically DM 3.6.0.20. The vulnerability enables pre-auth, unauthenticated remote command execution via the URI /sm/api/v1/firewall/zone/services, yielding root access and high-severity impact (CVSS v3.1: 9.8, CRITICAL). The conne...

CVE-2021-27562

CVE-2021-27562 affects Arm Trusted Firmware M through 1.2; the NS world can trigger a system halt, overwrite secure data, or print secure data via NSPE handler mode. CVSS indicates low–medium overall risk (LOCAL, LOW IT, HIGH availability impact). Public sources confirm details across NVD, CISA K...

CVE-2015-3035

TP-LINK routers are affected by CVE-2015-3035: a directory traversal in PATH_INFO triggered at /login/ that allows remote attackers to read arbitrary files. Affected models and firmware windows include Archer C5 (1.2) <150317, C7 (2.0) <150304, C8 (1.0) <150316, Archer C9 (1.0), TL-WDR35...

CVE-2011-2005

CVE-2011-2005 : Afd.sys in the Microsoft Windows XP (SP2/SP3) and Server 2003 (SP2) Ancillary Function Driver fails to properly validate user‑mode input before passing to kernel mode, enabling local privilege escalation. Exploitation climbs from a crafted user‑mode application to SYSTEM privilege...

CVE-2016-0040

CVE-2016-0040 is a Windows kernel privilege-escalation vulnerability (uninitialized-pointer issue) exploited locally on NT kernel surfaces. Public materials show a PoC/PoC-like exploit (MS16-014) overwriting kernel objects to gain SYSTEM/root privileges (e.g., ntoskrnl/Win32k surface). Exploit-DB...

CVE-2026-34480

Technical details about CVE-2026-34480 are not publicly available in the provided connected documents. The initial description gives an overview but no vendor/product/version specifics or remediation steps here. Monitor for updates from official advisories.

CVE-2018-0154

CVE-2018-0154 affects the Cisco IOS ISM‑VPN crypto engine. The issue stems from improper handling of VPN traffic, allowing an unauthenticated, remote attacker to trigger a DoS via crafted VPN traffic that can cause the device to hang or crash. Affected product: Cisco Integrated Services Module fo...

CVE-2013-0625

Adobe ColdFusion 9.0, 9.0.1, and 9.0.2 are affected by CVE-2013-0625, where an unauthenticated bypass is possible if a password is not configured, potentially enabling remote code execution via unspecified vectors; exploited in the wild in January 2013. (CVSS v2 base 6.8; CVSS v3.1 base 9.8). No ...

CVE-2011-1889

CVE-2011-1889 affects Microsoft Forefront Threat Management Gateway (TMG) 2010. The vulnerability is in the NSPLookupServiceNext function of the TMG Firewall Client Winsock provider, due to a memory corruption/bounds-checking flaw that enables remote code execution. Exploitation involved remote a...

CVE-2025-24166

Apple security advisory PT-2025-5329 links CVE-2025-24166 to a memory/state-management weakness that can be triggered by processing malicious web content, causing an unexpected process crash. Affected products and minimum patch levels cite: iPadOS before 17.7.4; macOS Ventura before 13.7.3; macOS...

CVE-2022-3515

CVE-2022-3515 affects the Libksba library, caused by an integer overflow in the CRL parser. The vulnerability can be exploited remotely by sending specially crafted data (for example, a malicious S/MIME attachment) to achieve code execution on the target system. Several connected advisories note ...

CVE-2018-0147

CVE-2018-0147 affects Cisco Secure Access Control System (ACS) prior to 5.8 patch 9. The root cause is insecure Java deserialization of user-supplied content, allowing unauthenticated remote attackers to execute arbitrary commands with root privileges on affected devices. Public sources in the co...

CVE-2024-38473

The CVE-2024-38473 issue affects Apache HTTP Server (mod_proxy) in versions up to 2.4.59, where improper/encoded request URL handling can allow requests to reach backends and potentially bypass authentication. Public references and advisories state the vulnerability arises from encoding problems ...

CVE-2019-6977

The CVE-2019-6977 issue affects the GD Graphics Library (LibGD) via gdImageColorMatch in gd_color_match.c. A heap-based buffer overflow in this function affects GD 2.2.5 and PHP builds before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1 when imagecolormatch processes cra...

CVE-2018-6882

Zimbra Collaboration Suite (ZCS) is affected by an XSS in ZmMailMsgView.getAttachmentLinkHtml. The vulnerability exists in ZCS before 8.7 Patch 1 and 8.8.x before 8.8.7, allowing remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment. Affected...

CVE-2017-12319

Cisco IOS XE Software EVPN BGP vulnerability CVE-2017-12319 allows an unauthenticated remote attacker to trigger a reload or BGP routing-table corruption, causing DoS. Root cause: changes in the BGP MPLS-Based EVPN RFC 7432 draft lead to miscalculation of the IP address length field when processi...

CVE-2025-30232

CVE-2025-30232 is confirmed to affect Exim4 (MTA) with a use-after-free in versions 4.96–4.98.1 that could allow a local attacker to escalate privileges. The Debian advisory notes the issue is fixed in exim4 package for stable (bookworm) as version 4.96-15+deb12u7, and recommends upgrading. The p...

CVE-2022-42856

CVE-2022-42856 is a type-confusion vulnerability in WebKit/WebKitGTK that could allow arbitrary code execution when processing malicious web content. The connected documents confirm impact across WebKit-based products, including Apple WebKit (Safari) and WebKitGTK, with fixes in Safari 16.2, macO...

CVE-2021-22506

Mode C: Affected product is Micro Focus Access Manager prior to version 5.0. The connected documents describe an Information Leakage vulnerability (CVE-2021-22506) in the Access Manager, arising from an advance configuration exposure that could disclose information. The Nessus entry additionally ...

CVE-2021-23874

CVE-2021-23874 affects McAfee Total Protection (MTP) versions prior to 16.0.30. The vulnerability is an Arbitrary Process Execution leading to local privilege escalation and code execution by a local user, bypassing MTP self-defense. Affected component: MTP privilege management; root cause: impro...

CVE-2017-12238

Cisco IOS on Catalyst 6800 Series switches (Cisco 6800-16P10G/16P10G-XL with Supervisor Engine 6T) is affected by CVE-2017-12238. The vulnerability stems from a memory management flaw in the VPLS code, exploitable by an unauthenticated, adjacent attacker who can flood the MAC address table with V...

CVE-2020-8908

CVE-2020-8908 (Guava) : A temp directory creation vulnerability exists in all Guava versions where guava’s API com.google.common.io.Files.createTempDir() creates temporary directories that are world-readable on Unix-like systems. The issue arises because the temp dir permissions are not restricte...

CVE-2018-0155

CVE-2018-0155 affects Cisco Catalyst 4500/4500-X switches where the BFD offload has insufficient error handling for incomplete BFD headers. An unauthenticated remote attacker can send crafted BFD messages to trigger a crash in the iosd process and potentially cause system reloads, resulting in Do...

CVE-2016-10174

The NETGEAR WNR2000v5 router is affected by a buffer overflow in the hidden_lang_avi parameter when invoking /apply.cgi?/lang_check.html. An unauthenticated attacker can cause remote code execution. Documentation and exploit sources (e.g., Metasploit module for WNR2000v5 and exploits in Exploit-D...

CVE-2016-8562

Siemens SIMATIC CP 1543-1 and SIPLUS NET CP 1543-1 (versions before 2.0.28) are affected by CVE-2016-8562. Under special conditions, SNMP variables on port 161/UDP, which should be read-only, can be written, potentially reducing availability or causing denial-of-service. The ICS advisory notes th...

CVE-2026-1642

The CVE-2026-1642 entry describes a vulnerability in NGINX OSS and NGINX Plus when configured to proxy to upstream TLS servers. Under a MITM position on the upstream side and conditions outside the attacker’s control, an attacker may inject plain text data into the response from an upstream proxi...

CVE-2022-21702

Grafana CVE-2022-21702 is an XSS vulnerability in the data source proxy and plugin proxy paths. Affected: Grafana HTTP-based datasources configured with Server as Access Mode and a URL, and HTTP-based app plugins configured with a URL (versions up to 8.3.4; back-end plugin resources also mentione...

CVE-2018-20060

CVE-2018-20060 affects urllib3/python-urllib3 prior to 1.23, where the Authorization header is not removed on cross-origin redirects. This can allow credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext. Public sources in the Connected documents ind...

CVE-2015-4068

Arcserve UDP vulnerable versions:

CVE-2018-19943

CVE-2018-19943 affects QNAP QTS File Station across multiple versions. The vulnerability is a cross-site scripting flaw that, if exploited, could allow remote attackers to inject malicious code. Public details from NVD and Nessus indicate QTS fixes have been released in several versions (e.g., QT...