CVE-2023-47108

The CVE-2023-47108 issue affects OpenTelemetry-Go Contrib's grpc Unary Server Interceptor in versions >=0.37.0 and

CVE-2023-4211

CVE-2023-4211 affects the Arm Mali GPU Kernel Driver. The issue is a use-after-free/resource management error in the Mali driver that allows a local, non-privileged user to perform improper GPU memory processing and access freed memory. Impact is limited to confidentiality (high impact) with no d...

CVE-2022-32894

CVE-2022-32894 is an out-of-bounds write in Apple’s kernel code that could allow arbitrary code execution with kernel privileges. Affected products include iOS/iPadOS/macOS kernel components (macOS Big Sur and newer). The issue was fixed in iOS 15.6.1, iPadOS 15.6.1, and macOS Monterey 12.5.1, wi...

CVE-2015-2545

CVE-2015-2545 affects Microsoft Office (2007 SP3, 2010 SP2, 2013 SP1, 2013 RT SP1) via a crafted EPS image that triggers memory corruption during EPS parsing, enabling remote code execution. FireEye details describe an EPS-encoded use-after-free in Office’s EPS handling (dict copy/forall flow) le...

CVE-2015-2424

CVE-2015-2424: Microsoft Office memory corruption in PowerPoint/Word components allows remote code execution or memory corruption via a crafted Office document. Affected products include PowerPoint 2007 SP3, Word 2007 SP3, PowerPoint 2010 SP2, Word 2010 SP2, PowerPoint 2013 SP1, Word 2013 SP1, an...

CVE-2008-5161

CVE-2008-5161 is an SSH CBC-mode CBC vulnerability where error handling in CBC-based ciphers could allow remote attackers to recover plaintext from arbitrary SSH ciphertext blocks. The vulnerability affects multiple SSH implementations including OpenSSH 4.7p1 and various SSH clients/servers (as l...

CVE-2017-6327

CVE-2017-6327 affects Symantec Messaging Gateway prior to 10.6.3-267, with unauthenticated remote code execution through the web interface. Reports describe a pre-auth flaw (RestoreAction/web login handling) enabling arbitrary command execution with root privileges on affected appliances, exposed...

CVE-2016-4657

CVE-2016-4657 refers to a memory corruption vulnerability in Apple WebKit used by iOS, prior to 9.3.5. The issue could allow a remote attacker to execute arbitrary code or cause a denial of service when a user visits a crafted website. Affected product is WebKit in iOS (and related WebKit-based c...

CVE-2024-12706

CVE-2024-12706 describes an SQL Injection in OpenText Digital Asset Management. An authenticated user could cause arbitrary SQL commands to execute against the underlying database due to improper input handling. Affected products include Digital Asset Management up to version 24.4. Reported data ...

CVE-2014-4148

CVE-2014-4148 is a remote code execution vulnerability in Windows kernel-mode driver win32k.sys caused by improper handling of TrueType fonts. It affects multiple Windows versions (server 2003 SP2, Vista, 2008, 7, 8/8.1, Server 2012) and is referenced publicly as MS14-058. Public exploitation exi...

CVE-2021-22555

CVE-2021-22555 is a Linux kernel heap out-of-bounds write vulnerability in net/netfilter/x_tables.c, dating to 2.6.19-rc1. The issue allows a local attacker to gain privileges or cause a DoS via heap memory corruption in the username space. Public sources in the connected docs confirm the vulnera...

CVE-2023-0056

CVE-2023-0056 affects HAProxy and is described in connected advisories as an uncontrolled resource consumption DoS that can crash the service, including a scenario where an authenticated remote attacker could trigger a crafted server in an OpenShift cluster. The issue is associated with HAProxy’s...

CVE-2019-9637

CVE-2019-9637 concerns a PHP file-rename across filesystems: during the rename, the target may briefly have incorrect permissions, potentially allowing unauthorized data access. The initial description specifies affected PHP versions: before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Co...

CVE-2021-46906

CVE-2021-46906 — Linux kernel HID (usbhid) info leak fix : The vulnerability arises in hid_submit_ctrl where report->size of zero caused transfer_buffer_length to be calculated as 16384, enabling an information leak. The root cause is the calculation in hid_report_len() not handling a zero-siz...

CVE-2020-13938

CVE-2020-13938 affects Apache HTTP Server 2.4.0–2.4.46. The vulnerability allows unprivileged local users to stop the httpd service on Windows. The connected sources confirm the affected product family and the local-access impact, with public advisories referencing Microsoft Windows behavior and ...

CVE-2021-25329

The CVE-2021-25329 entry is tied to an incomplete fix for CVE-2020-9484 in Apache Tomcat. In affected releases (Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61, and 7.0.0 to 7.0.107) a configuration edge case that was deemed highly unlikely could leave the Tomcat instance vulnerab...

CVE-2011-3188

CVE-2011-3188 affects the Linux kernel prior to 3.1, where IPv4 and IPv6 sequence numbers/Fragment IDs are generated with a modified MD4. This predictable value generation enables remote attackers to cause DoS or hijack sessions by crafting packets. The vulnerability is mitigated by upgrading the...

CVE-2023-2878

CVE-2023-2878 affects Kubernetes secrets-store-csi-driver. The vulnerability occurs in versions before 1.3.3, where the driver discloses service account tokens in logs. This could allow an attacker with local access or log access to read leaked tokens, enabling impersonation of the associated ser...

CVE-2020-8468

CVE-2020-8468 affects Trend Micro Apex One (2019), OfficeScan XG and Worry‑Free Business Security agents. Described as a content validation escape vulnerability that could allow an attacker to manipulate agent client components; an attack requires user authentication. The connected documents prov...

CVE-2015-2426

CVE-2015-2426 is a Windows OpenType Font Driver vulnerability (ATMFD.DLL) that causes a pool/heap overflow when processing OpenType fonts, allowing remote code execution. The issue arises from a flawed handling of font data (notably the Class1Count field in the GPOS/CFF paths) where an invalid ze...

CVE-2021-41184

CVE-2021-41184 describes an XSS in jQuery-UI before 1.13.0 where untrusted input passed to the of option of the .position() utility could lead to code execution. The connected documents confirm the issue affects jQuery-UI embedded in other software (e.g., OTRS/IU contexts) and state the fix is to...

CVE-2015-2387

CVE-2015-2387 discusses a local privilege-escalation in the ATMFD.DLL component of the Windows Adobe Type Manager Font Driver. Concrete details from connected sources show multiple OTF/TTF vulnerabilities in ATMFD.DLL (and related font subsystems) that allowed memory corruption via crafted font d...

CVE-2022-26258

CVE-2022-26258 affects D-Link DIR-820L devices (firmware around 1.05B03). Multiple open‑source scanners and NVD entries describe a remote code execution (RCE) vulnerability in this model, with initial reports citing an RCE via HTTP POST to get set ccp and separate notes of an RCE via the Device N...

CVE-2021-27229

CVE-2021-27229 affects Mumble prior to 1.3.4. A remote code execution vulnerability exists when a user navigates to a crafted URL in a server list and clicks the Open Webpage text, enabling arbitrary code execution. Several advisories confirm the issue and patch guidance: upgrade to Mumble 1.3.4 ...

CVE-2019-18187

CVE-2019-18187 affects Trend Micro OfficeScan versions 11.0 and XG (12.0). The issue is a directory traversal in ZIP handling that allows extracting files to a specific OfficeScan server folder, potentially enabling remote code execution. Exploitation requires an authenticated context (web servic...

CVE-2014-8439

CVE-2014-8439 describes a dereferenced memory pointer vulnerability in Adobe Flash Player (and related AIR components) that could allow remote code execution. The initial entry lists multiple affected branches: Flash Player versions prior to 13.0.0.258, 14.x, and 15.x before 15.0.0.239 on Windows...

CVE-2023-24538

CVE-2023-24538 concerns Go’s html/template backtick handling within JavaScript template literals. The vulnerability arises when a template contains a Go template action inside a JS template literal (e.g., var a = {{.}}); such content can be used to terminate the literal and inject arbitrary JavaS...

CVE-2020-8467

CVE-2020-8467 affects Trend Micro Apex One (2019) and OfficeScan XG via a vulnerability in the migration tool component that enables remote code execution. The attack requires user authentication to be attempted. NVD scoring indicates high impact (CVSSv3.1 base 8.8; HIGH). CISA KEV catalogs this ...

CVE-2016-6366

CVE-2016-6366 is a buffer overflow in Cisco ASA software (SNMP code) that allows an authenticated, remote attacker to cause a reload or remotely execute code via crafted IPv4 SNMP packets. The vulnerability affects multiple Cisco devices and ASA platforms, including ASA 5500, 5500-X, ASA Services...

CVE-2022-4304

CVE-2022-4304 describes a timing-based side‑channel in OpenSSL’s RSA decryption implementation that could allow recovering plaintext over the network via a Bleichenbacher‑style attack. It affects all RSA padding modes (PKCS#1 v1.5, RSA‑OAEP, and RSASVE). The connected Astra Linux bulletin reprodu...

CVE-2022-30522

CVE-2022-30522 affects Apache HTTP Server mod_sed; when input to mod_sed is very large, it can cause excessive memory allocations and aborts, impacting availability. The issue is documented across multiple feeds (e.g., CVE page for 2.4.53 context and later advisories) and is addressed by updating...

CVE-2015-0311

CVE-2015-0311 affects Adobe Flash Player on Windows/macOS up to 16.0.0.287 and Linux 11.2.202.438, described as an unspecified vulnerability that allowed remote code execution via unknown vectors. Exploitation in the wild was reported in January 2015. Connected sources confirm this is a remote-co...

CVE-2023-22515

CVE-2023-22515 affects Atlassian Confluence Data Center and Server. The issue is a broken access control vulnerability that enables an unauthenticated attacker to create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are not affected, and ins...

CVE-2013-3587

CVE-2013-3587 (BREACH) concerns TLS/SSL data compression leaks where compressed HTTPS responses reveal plaintext by observing size differences. The linked documents confirm this is a BREACH-type issue affecting HTTPS with HTTP compression, not tied to a single product. Mitigations documented incl...

CVE-2015-5123

CVE-2015-5123 describes a use-after-free in the BitmapData class of the ActionScript 3 (AS3) implementation in Adobe Flash Player . The vulnerability allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) by crafting Flash content that overrides a value...

CVE-2022-43552

The CVE-2022-43552 vulnerability affects curl

CVE-2015-1642

CVE-2015-1642 affects multiple Microsoft Office products (Office 2007 SP3, 2010 SP2, 2013 SP1) via memory corruption when parsing crafted Office files, allowing remote code execution. Microsoft issued MS15-081 with a suite of updates (e.g., 2687409 for Office 2007/2010/2013 components and related...

CVE-2024-56512

CVE-2024-56512 (Apache NiFi) affects NiFi 1.10.0–2.0.0, where creating a new Process Group omits fine‑grained authorization checks for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers. As a result, authenticated users with permission to create Process Groups ...

CVE-2022-22536

CVE-2022-22536 affects SAP NetWeaver components (ABAP/Java stacks), ABAP Platform, SAP Content Server 7.53, and SAP Web Dispatcher. The issue is HTTP request smuggling/concatenation caused by how the SAP ICM front end parses requests, enabling an unauthenticated attacker to prepend arbitrary data...

CVE-2014-9163

Adobe Flash Player is affected by CVE-2014-9163: a stack-based buffer overflow allows remote code execution. Affected: Windows and OS X Flash Player before 13.0.0.259 and 14.x before 15.0.0.246, and Linux Flash Player before 11.2.202.425. Root cause: stack-based overflow in vulnerable code paths;...

CVE-2007-4559

Summary (fact-grounded) : The connected advisory describes a directory traversal vulnerability in Python's tarfile extraction path as used by Keras’ get_file() in keras.utils.get_file(), where extractall() is called without a security filter. The root cause is a PATH_MAX symlink resolution bug th...

CVE-2019-10086

CVE-2019-10086 affects Apache Commons BeanUtils 1.9.2, where a BeanIntrospector addition could suppress access to the classloader via the class property on Java objects. The issue stems from not applying the suppression by default in PropertyUtilsBean, enabling potential risk across affected depl...

CVE-2023-2976

The CVE-2023-2976 issue affects Google Guava’s FileBackedOutputStream in versions 1.0–31.1, where files created in the default Java temporary directory on Unix and Android ICS can be accessed by other users/apps. The NVD notes the vulnerability could expose data with high impact to confidentialit...

CVE-2019-0676

CVE-2019-0676 is an Internet Explorer information-disclosure vulnerability caused by improper handling of memory objects, enabling an attacker to test for the presence of files on disk. The affected component is IE’s memory handling (JScript/Win32k context noted in analyses), with exploitation ob...

CVE-2025-27517

Volt (Livewire) contains a remote code execution vulnerability in Volt components triggered by malicious, user-crafted payloads. Affected versions are prior to 1.7.0; the issue is fixed in 1.7.0. The CVE entry documents the vulnerability as critical with network attack vector and no user interact...

CVE-2019-7286

CVE-2019-7286 is a memory corruption bug in iOS CFPrefsDaemon that could enable privilege escalation. Project Zero and related analyses show it as one of five iPhone exploit chains used in targeted in-the-wild campaigns, with chain components exploiting iOS WebKit/kernel paths. Apple released a f...

CVE-2026-35386

OpenSSH CVE-2026-35386 affects OpenSSH before 10.3. The vulnerability allows potential command execution via shell metacharacters in a username supplied on the command line, requiring an untrusted username and a non-default ssh_config with a % in use. Connected advisories (OpenSSH

CVE-2018-9416

CVE-2018-9416 concerns memory corruption in the Linux kernel SCSI driver, specifically in sg_remove_scat (scsi/sg.c). The root cause is described as an unusual root cause leading to local escalation of privilege with System execution privileges needed; no user interaction required. Connected docu...

CVE-2022-41128

CVE-2022-41128 is a Windows Scripting Languages Remote Code Execution vulnerability in the JScript9 scripting language. Reports consistently describe a network-exploitable RCE where visiting a malicious site can trigger memory corruption and arbitrary code execution on affected Windows systems. E...

CVE-2007-4752

CVE-2007-4752 affects OpenSSH before 4.7. When OpenSSH fails to create an untrusted X11 cookie, it falls back to a trusted X11 cookie, allowing an X client to be treated as trusted and potentially enabling privilege escalation. The linked Nessus advisories cite OpenSSH pre-4.7 in multiple distrib...