CVE-2013-0631

CVE-2013-0631 concerns an information-disclosure vulnerability in Adobe ColdFusion 9.0, 9.0.1, and 9.0.2. The published data indicate that an attacker could obtain sensitive information via unspecified vectors, with exploitation reported in the wild in January 2013. The CVSS data from NVD shows a...

CVE-2017-8540

CVE-2017-8540 affects Microsoft Malware Protection Engine (MMPE) across Forefront/Defender deployments. The weakness arises from a use-after-free in the garbage collection system managing JavaScript objects during scanning of specially crafted files, enabling memory corruption and potential remot...

CVE-2009-0563

CVE-2009-0563 is a Stack-based buffer overflow in Microsoft Word components that allows remote code execution when a user opens a crafted Word document with an invalid length field. Affected products include Word 2002 SP3, 2003 SP3, Word 2007 SP1/SP2, Office for Mac 2004/2008, Open XML File Forma...

CVE-2019-10758

MongoDB mongo-express ≤0.53.x is vulnerable to Remote Code Execution via endpoints using toBSON, due to unsafe use of the vm module to run exec commands. Affected component: mongo-express server-side routes that invoke toBSON. Root cause: misusing vm to execute commands in a non-safe environment....

CVE-2018-7841

Schneider Electric U.motion Builder 1.3.4 is affected by a remote code execution vulnerability due to improper input sanitization in the track_import_export.php object_id parameter. The Nuclei template for CVE-2018-7841 describes an unauthenticated command injection that lets an attacker execute ...

CVE-2014-3566

CVE-2014-3566 (POODLE) affects SSLv3 in AIX and related IBM components. IBM’s advisory (nettcp) states SSLv3 padding oracle vulnerability could allow MITM decryption of SSL sessions. Affected: AIX 6.1/7.1 and VIOS 2.2.x with vulnerable bos.net.tcp.client/server file sets (various lower/upper leve...

CVE-2017-12231

Cisco IOS NAT denial-of-service vulnerability (CVE-2017-12231) affects IOS 12.4–15.6 where NAT ALG improperly translates H.323 RAS messages, allowing unauthenticated remote DoS via crafted IPv4 packets. Affected devices using NAT ALG for H.323 RAS messages can crash and reload. Exploitation detai...

CVE-2016-4656

CVE-2016-4656 is an Apple iOS kernel memory‑corruption vulnerability that can allow an attacker to execute arbitrary code with kernel privileges or cause a DoS via a crafted app. Affected are iOS versions prior to 9.3.5; Apple’s security content notes the kernel memory corruption issue was addres...

CVE-2009-0557

CVE-2009-0557 describes an Object Record Corruption vulnerability in Microsoft Office Excel across multiple platforms (Office 2000 SP3, XP SP3, 2003 SP3, Mac editions, and Excel Viewer/Compatibility Pack). The root cause is a malformed record object in an Excel file, enabling remote code executio...

CVE-2017-12235

The CVE-2017-12235 issue is a DoS flaw in Cisco IOS Software’s PROFINET Discovery and Configuration Protocol (PN-DCP) handling. It affects Cisco IOS on devices configured to process PN-DCP (notably Cisco Industrial Ethernet Switches) and stems from improper parsing of PN-DCP Identify Request pack...

CVE-2016-3643

SolarWinds Virtualization Manager

CVE-2018-0180

Cisco IOS Software CVE-2018-0180 describes multiple DoS vulnerabilities in the Login Enhancements (Login Block) feature, enabling an unauthenticated, remote attacker to trigger a device reload. Affected are Cisco devices running IOS releases 15.4(2)T, 15.4(3)M, or 15.4(2)CG and later. The root ca...

CVE-2013-0641

CVE-2013-0641 is a buffer overflow in Adobe Reader and Acrobat versions prior to certain patches that allows a remote attacker to execute arbitrary code via a crafted PDF. The description specifies impact as remote code execution, with exploitation observed in the wild in February 2013. Affected ...

CVE-2019-11769

CVE-2019-11769 affects TeamViewer 14.2.2558. The issue arises when updating as a non-administrative user, where GUI-entered administrative credentials are processed in Teamviewer.exe and can be intercepted in cleartext in the non-admin process memory. This enables a local attacker to obtain crede...

CVE-2018-19396

CVE-2018-19396 affects PHP 5.x through 7.1.24. The issue lies in ext/standard/var_unserializer.c where an unserialize call for the com, dotnet, or variant class can cause a denial of service (application crash). Several connected advisories (EulerOS/OpenVAS/NVD entries) document this vulnerabilit...

CVE-2012-5054

CVE-2012-5054 specifies an integer overflow in the Matrix3D.copyRawDataTo method of Adobe Flash Player, enabling remote code execution via malformed arguments. Affected component: Flash Player (Matrix3D class). Root cause: integer overflow in copyRawDataTo. Impact: arbitrary code execution with n...

CVE-2016-4994

CVE-2016-4994 is a Use‑after‑free vulnerability in GIMP’s XCF file loader (function xcf_load_image in app/xcf/xcf-load.c). An attacker could craft an XCF file to crash GIMP or potentially execute arbitrary code. Public discussions and advisories indicate multiple use‑after‑free bugs in the channe...

CVE-2016-2386

CVE-2016-2386 affects SAP NetWeaver J2EE Engine 7.40, specifically the UDDI server. The vulnerability is a SQL injection that allows remote attackers to execute arbitrary SQL commands via unspecified vectors, with exploitation attempts documented in PoCs and exploits targeting the UDDI interface ...

CVE-2012-2539

CVE-2012-2539 is Microsoft Word remote code execution vulnerability caused by parsing crafted RTF data (Word RTF 'listoverridecount'). It affects Word 2003 SP3, 2007 SP2/SP3, 2010 SP1; Word Viewer; Office Compatibility Pack SP2/SP3; and Office Web Apps 2010 SP1. The underlying issue is memory cor...

CVE-2010-2572

CVE-2010-2572 describes a remote code execution vulnerability in Microsoft PowerPoint 2002 SP3 and 2003 SP3 caused by an error in parsing PowerPoint 95 files (PowerPoint Parsing Buffer Overflow). The issue could allow an attacker to take complete control of an affected system by convincing a user...

CVE-2020-11945

Squid vulnerability CVE-2020-11945 is confirmed in various advisories for Squid prior to 5.0.2, where a remote attacker can replay a sniffed Digest Authentication nonce due to overflow of the nonce reference counter, potentially enabling remote code execution if pooled token credentials are freed...

CVE-2026-46331

CVE-2026-46331 affects the Linux kernel net/sched pedit action (tcf_pedit_act). The root cause is an incorrect copy-on-write (COW) range calculation: skb_ensure_writable() was called once before the key loop using tcfp_off_max_hint, which does not account for runtime header offsets added by typed...

CVE-2021-38163

CVE-2021-38163 affects SAP NetWeaver (Visual Composer 7.0 RT) versions 7.30/7.31/7.40/7.50 with an unrestricted file upload path traversal that, when exploited by an authenticated non-administrative user, can trigger processing of a malicious file and execute OS commands under the Java Server pro...

CVE-2018-8653

CVE-2018-8653 is a remote code execution vulnerability in Microsoft Internet Explorer’s scripting engine memory handling (JScript). Affected: IE 9, 10, and 11. Root cause: memory corruption within the scripting engine when handling in-memory objects, enabling an attacker to execute arbitrary code...

CVE-2018-8611

CVE-2018-8611 – Windows kernel elevation of privilege . The vulnerability arises because the Windows kernel fails to properly handle objects in memory, enabling a local attacker to run arbitrary code in kernel mode and perform actions such as installing programs, changing data, or creating accoun...

CVE-2023-5217

CVE-2023-5217 is a heap buffer overflow in VP8 encoding in libvpx (affecting Google Chrome before 117.0.5938.132 and libvpx 1.13.1). A crafted HTML page could remotely trigger heap corruption. Multiple connected sources confirm the vulnerability in libvpx/WebP contexts; Apple’s advisory notes CVE...

CVE-2023-27930

CVE-2023-27930 is a kernel-level type confusion vulnerability addressed by Apple in iOS 16.5 / iPadOS 16.5, watchOS 9.5, tvOS 16.5, and macOS Ventura 13.4. The issue allows an app to potentially execute arbitrary code with kernel privileges due to a type confusion in the kernel; Apple notes impro...

CVE-2021-21300

Summary: CVE-2021-21300 affects Git when cloning into case-insensitive file systems and using certain clean/smudge filters (e.g., Git LFS). A specially crafted repository containing symbolic links and files processed by these filters can cause an unchecked script to run during checkout. Affected ...

CVE-2018-0179

CVE-2018-0179 describes DoS in Cisco IOS Software due to vulnerabilities in the Login Enhancements (Login Block) feature. Affected are Cisco IOS releases 15.4(2)T, 15.4(3)M, 15.4(2)CG and later. An unauthenticated, remote attacker can trigger a device reload, causing DoS. The connected Cisco advi...

CVE-2014-0780

CVE-2014-0780 affects InduSoft Web Studio NTWebServer in version 7.1 prior to SP2 Patch 4. The NTWebServer directory traversal flaw lets remote attackers read APP password files and can lead to remote code execution. Exploitation is described as remote and not requiring authentication, enabling u...

CVE-2020-28949

CVE-2020-28949 affects PEAR Archive_Tar (v1.4.10 and earlier). The issue is that Archive_Tar’s filename sanitization only addressed phar attacks; other stream-wrapper attacks (e.g., file://) can overwrite files, enabling potential arbitrary file writes. Affected ecosystem includes PHP-pear compon...

CVE-2017-18362

Summary: CVE-2017-18362 affects Kaseya VSA via ConnectWise ManagedITSync. It allows unauthenticated remote commands to access and modify the Kaseya VSA database when ManagedIT.asmx is reachable through the web interface. The vulnerability has been actively exploited in the wild (February 2019) to...

CVE-2013-2729

CVE-2013-2729 : Integer overflow in Adobe Reader/Acrobat BMP/RLE image handling can lead to arbitrary code execution. Affected: Adobe Reader/Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03. Root cause: heap/buffer overflow while parsing embedded BMP RLE resources in PDFs. Im...

CVE-2017-14174

CVE-2017-14174 : ImageMagick 7.0.7-0 Q16 contains a DoS in ReadPSDLayersInternal() due to missing EOF check when parsing PSDs. A crafted PSD that claims a large length but lacks data can trigger a loop over length that consumes massive CPU, as described in the entry. The vulnerability is in coder...

CVE-2012-0518

Oracle Fusion Middleware – Oracle Application Server Single Sign-On (SASO) 10.1.4.3.0 is listed as vulnerable in CVE-2012-0518, with the issue related to Redirects and affecting integrity. A connected PT-2012-4537 entry confirms the affected version (10.1.4.3.0) and notes there is no information ...

CVE-2009-2055

Cisco IOS XR (Cisco IOS XR software) versions 3.4.0–3.8.1 are affected by a BGP UPDATE handling DoS vulnerability (CVE-2009-2055). The issue allows remote attackers to cause a denial of service by sending a BGP UPDATE with an invalid attribute, resulting in a session reset of the BGP peering. Dem...

CVE-2020-9377

D-Link DIR-610 is affected by CVE-2020-9377, a remote code execution vulnerability in the cmd parameter of command.php. The issue affects devices that are no longer supported by the maintainer. Connected sources corroborate additional vulnerabilities in the same device family (e.g., information d...

CVE-2017-6316

CVE-2017-6316 affects Citrix NetScaler SD-WAN devices (including CloudBridge) up to version 9.1.2.26.561201, where a remote attacker can execute arbitrary shell commands as root by abusing a cookie (CGISESSID on NetScaler SD-WAN; CAKEPHP on CloudBridge). The vulnerability arises from insufficient...

CVE-2017-6862

Netgear WNR2000 series (WNR2000v3 prior to 1.1.2.14, WNR2000v4 prior to 1.0.0.66, WNR2000v5 prior to 1.0.0.42) are affected by a buffer-overflow vulnerability in the administration web interface that allows authentication bypass and remote code execution. The root cause is a buffer overflow trigg...

CVE-2022-31160

CVE-2022-31160 affects jQuery UI versions prior to 1.13.2. The issue occurs when initializing a checkboxradio widget on an input inside a label; the label contents can be treated as the input label, and refreshing with .checkboxradio("refresh") on such a widget may decode encoded HTML entities in...

CVE-2018-0159

CVE-2018-0159 affects Cisco IOS/IOS XE: IKEv1 implementation vulnerability where improper validation of specific IKEv1 packets allows an unauthenticated, remote attacker to reload an affected device, causing DoS during IKE negotiation. Root cause: packet validation flaw in IKEv1 handling. Impact:...

CVE-2022-42475

Fortinet FortiOS SSL-VPN (and FortiProxy SSL-VPN) suffer a heap-based buffer overflow (CWE-122) leading to remote code execution. A remote unauthenticated attacker can trigger via crafted requests, affecting FortiOS/FortiProxy versions up to 7.2.2, 7.0.x, 6.4.x, 6.2.x, 6.0.x and earlier. CVSS v3....

CVE-2018-19953

CVE-2018-19953 is a cross-site scripting vulnerability in QNAP NAS File Station affecting multiple QTS releases. The description indicates that, if exploited, remote attackers could inject malicious code. QNAP has issued fixes in several QTS versions (e.g., 4.4.2.1231; 4.4.1.1201; 4.3.6.1218; 4.3...

CVE-2019-0808

Technical details (affected software, vulnerable component, root cause, impact, fixes) are not provided in the connected documents. Please monitor for updates from official advisories.

CVE-2018-20753

Summary : CVE-2018-20753 affects Kaseya VSA RMM on-premises. Vulnerable versions : RMM before 9.3.0.35, before 9.4.0.36, and before 9.5.0.5. Impact : unprivileged remote attackers can execute PowerShell payloads on all managed devices. Exploitation note : attackers were active in the wild in Janu...

CVE-2015-1701

CVE-2015-1701 is a Win32k.sys kernel-mode privilege-escalation flaw affecting Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2. The issue stems from improper handling within win32k, notably around the ClientCopyImage/SetWindowLongPtr path, enabling a crafted user-mode input to execute code...

CVE-2025-32965

CVE-2025-32965 affects xrpl.js, a JavaScript/TypeScript API for the XRP Ledger. Versions 4.2.1–4.2.4 and 2.14.2 are compromised, containing malicious code designed to exfiltrate private keys. The High-risk impact includes potential key exposure and compromised confidentiality and integrity of aff...

CVE-2023-45285

CVE-2023-45285 : Golang Go could allow a remote attacker to obtain sensitive information when using go get to fetch a module with the ".git" suffix. The vulnerability arises because, if the module is not available via secure https or git+ssh, the fetch may fall back to the insecure git:// protoco...

CVE-2017-12234

CVE-2017-12234 affects Cisco IOS Software CIP implementation (versions 12.4–15.6). The issue stems from improper parsing of crafted CIP packets, allowing an unauthenticated, remote attacker to cause the device to reload and trigger DoS. Affected components are Cisco IOS/CIP handling; exploit reli...

CVE-2016-4523

CVE-2016-4523 affects Trihedral VTScada (VTS) WAP interface on Windows, with VTScada versions 8.x through 11.x prior to 11.2.02. The vulnerability allows remote attackers to cause a denial of service via an out-of-bounds read that crashes the application. Public disclosures and mitigations descri...