CVE-2023-22952

SugarCRM is affected by CVE-2023-22952, a remote code execution in the EmailTemplates flow before 12.0, hotfix 91155. An attacker can upload a crafted PNG with embedded PHP to /index.php?module=EmailTemplates&action=AttachFiles (no input validation) and execute code on the server. Some sources in...

CVE-2016-3427

CVE-2016-3427 is an unspecified vulnerability in Oracle Java SE (affecting 6u113, 7u99, 8u77) and JRockit, tied to the Java Management Extensions (JMX) component. Exploitation can affect confidentiality, integrity, and availability via JMX-related vectors; the issue is described as an unspecified...

CVE-2020-10735

CVE-2020-10735 affects Python’s integer parsing with non-binary bases, where int("text") on very long digit strings can cause a CPU DoS, impacting availability. The flaw is present in Python’s PyLong_FromString path and manifests in quadratic-time scenarios when parsing large decimal-like strings...

CVE-2022-23443

FortiSOAR flaw (CVE-2022-23443) : Fortinet FortiSOAR before 7.2.0 has improper access control (CWE-284) that allows unauthenticated attackers to access gateway API data via crafted HTTP GET requests. Exploitation occurs over the network with no auth. Advisories from FortiGuard (FG-IR-22-041) and ...

CVE-2010-4221

CVE-2010-4221 describes a remote code execution vulnerability in ProFTPD’s TELNET IAC handling. Multiple stack-based buffer overflows in pr_netio_telnet_gets (netio.c) allow unauthenticated attackers to potentially execute arbitrary code by crafting TELNET IAC sequences to FTP/FTPS services. The ...

CVE-2025-47273

CVE-2025-47273 affects setuptools by a path traversal in PackageIndex prior to 78.1.1, allowing writing files to arbitrary locations with the process’s permissions and potentially enabling remote code execution in context. Affected: setuptools package (Python ecosystem). The issue is fixed in ver...

CVE-2024-11235

CVE-2024-11235 affects PHP 8.3.x before 8.3.19 and 8.4.x before 8.4.5. The issue is a use-after-free caused by a code sequence involving the __set handler or the ??= operator in the presence of exceptions, which an attacker could exploit if they can influence memory layout (e.g., crafted inputs) ...

CVE-2020-26116

CVE-2020-26116 affects Python’s http.client/httplib in 3.x releases. The issue allows CRLF injection when an attacker controls the HTTP request method, demonstrated by inserting CR/LF into the first argument of HTTPConnection.request. Affected versions include Python 3.x before 3.5.10, 3.6.x befo...

CVE-2020-11080

In nghttp2, CVE-2020-11080 is a denial-of-service vulnerability caused by an overly large HTTP/2 SETTINGS frame payload in versions before 1.41.0. A PoC repeatedly sends a 14,400-byte SETTINGS frame (2400 settings entries), spiking CPU. The issue is mitigated by upgrading to nghttp2 1.41.0 or lat...

CVE-2022-0028

CVE-2022-0028 is a PAN-OS URL filtering misconfiguration that enables reflected and amplified TCP DoS (RDoS) against a target from Palo Alto Networks PA-Series/VM-Series/CN-Series firewalls. Affected component is the URL filtering configuration; root cause is a misconfigured URL filtering profile...

CVE-2010-3492

CVE-2010-3492 (Python asyncore accept handling) is a vulnerability in Python before 3.2 where the asyncore module does not properly handle unsuccessful calls to accept, and lacks guidance for daemon applications on handling such calls. This leads to denial-of-service by remote attackers terminati...

CVE-2024-12343

TP-Link VN020 F3v(T) TT_V6.2.1021 is affected, specifically the SOAP Request Handler’s /control/WANIPConnection component where manipulating the NewConnectionType argument triggers a buffer overflow. This vulnerability requires local-network access and has public exploitation information, with po...

CVE-2023-3446

CVE-2023-3446 affects OpenSSL DH parameter checks (DH_check, DH_check_ex, EVP_PKEY_param_check). Affected checks may slow down or stall when modulus values are large, potentially causing Denial of Service if parameters are from untrusted sources. The issue is tied to how DH parameter validation i...

CVE-2023-36883

CVE-2023-36883 concerns a spoofing vulnerability in Microsoft Edge for iOS. The initial description identifies the issue as a spoofing vulnerability affecting Edge on iOS, but does not provide details on root cause, affected versions beyond the platform, or concrete exploitation methods. CVSS met...

CVE-2023-21779

CVE-2023-21779 is a Visual Studio Code remote code execution vulnerability. The entry indicates a HIGH severity (CVSSv3.1 7.8) with a local attack vector, requiring user interaction, and impacting the confidentiality, integrity, and availability of affected systems. The vulnerability is documente...

CVE-2023-20108

CVE-2023-20108 affects Cisco Unified Communications Manager IM&P, specifically the XCP Authentication Service. The vulnerability stems from improper validation of user-supplied input in the authentication process, and a remote, unauthenticated attacker can trigger a crafted login message to cause...

CVE-2022-31030

CVE-2022-31030 affects containerd’s CRI ExecSync path, where containered processes can cause unbounded memory growth in the containerd daemon, risking host memory exhaustion and denial of service. The connected documents confirm the root cause is within containerd’s CRI implementation and state f...

CVE-2012-0031

CVE-2012-0031 affects Apache HTTP Server 2.2.21 and earlier, specifically scoreboard.c. The vulnerability allows local users to cause a denial of service (daemon crash during shutdown) or potentially other unspecified impact by modifying a type field in a shared scoreboard Memory segment, which l...

CVE-2022-22396

CVE-2022-22396 affects IBM Spectrum Protect Plus 10.1.0.0–10.1.9.3, where credentials may be disclosed in plaintext in the virgo log file in certain operations (remote vSnap, offload targets, or VADP credentials). API-key or certificate credentials are not printed. The issue’s root cause is infor...

CVE-2020-25683

CVE-2020-25683 affects dnsmasq up to version 2.83. Root cause: heap-based buffer overflow in DNSSEC processing due to missing length checks in rfc1035.c:extract_name() and related get_rdata()/sort_rrset paths. Exploitation: remote attacker can craft valid DNS replies to cause a heap overflow, cra...

CVE-2021-23336

CVE-2021-23336 affects Python CPython across multiple branches (0 and before 3.6.13; 3.7.0 before 3.7.10; 3.8.0 before 3.8.8; 3.9.0 before 3.9.2). The vulnerability is Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs using parameter cloaking with semicolons, causing the pr...

CVE-2004-0230

Technical details beyond the public description are not provided in the supplied documents. CVE-2004-0230 describes a TCP sequence-number guessing/RST-injection denial-of-service under large window size; no remediation details are given here.

CVE-2025-0442

CVE-2025-0442 involves Google Chrome’s Payments UI: an Inappropriate implementation vulnerability in Chrome prior to 132.0.6834.83 could allow UI spoofing via a crafted HTML page when a user performs specific UI gestures. Connected sources confirm the issue in Chromium/Chrome with this exact CVE ...

CVE-2023-36761

CVE-2023-36761 is a Microsoft Word information disclosure vulnerability. Connected sources note exploitation in the wild and indicate NTLM relay as a possible attack outcome. Affected products include various Word/Office deployments (Microsoft Word/Office suite). The vulnerability is being tracke...

CVE-2021-1242

CVE-2021-1242 affects Cisco Webex Teams (Webex/Jabber client) where the shared-file name display can be manipulated due to improper character rendering. An unauthenticated, remote attacker could share a file to alter how the file name appears in the messaging interface, enabling phishing or spoof...

CVE-2025-1782

CVE-2025-1782 affects HylaFAX Enterprise Web Interface and AvantFAX. The vulnerability arises from an unsanitized language form element that can be abused to include an arbitrary file in PHP code, enabling an authenticated attacker to perform actions as the web server user. The available document...

CVE-2024-21410

CVE-2024-21410 is a Microsoft Exchange Server Elevation of Privilege vulnerability with CVSS v3.1 base score 9.8 (CRITICAL). Affected products include Exchange Server 2016 CU23 and 2019 CU13/CU14. Public exploits exist; there are indications of exploitation in the wild per CISA KEV and vendor adv...

CVE-2023-38180

CVE-2023-38180 is a .NET/Visual Studio denial-of-service vulnerability (DoS) affecting .NET Core and related components. The CVSSv3.1 vector indicates Network attack, low attack complexity, no privileges required, with no confidentiality/integirty impact but a High availability impact. Moderate-t...

CVE-2022-41073

CVE-2022-41073 — Windows Print Spooler Elevation of Privilege affects Windows Print Spooler. Connected docs note exploitation in the wild and public patching via Microsoft updates (Nov 2022 Patch Tuesday). Remediation is to apply the Microsoft update for CVE-2022-41073 per MSRC/update guidance in...

CVE-2021-21157

CVE-2021-21157 : Use-after-free in the Web Sockets component of Chromium/ Google Chrome on Linux prior to 88.0.4324.182. The underlying issue is a use-after-free that could allow a remote attacker to potentially execute arbitrary code via a crafted HTML page, with impact described as heap corrupt...

CVE-2024-48843

CVE-2024-48843 affects ABB ASPECT – Enterprise v3.08.02, NEXUS Series v3.08.02, and MATRIX Series v3.08.02. The connected sources consistently describe a Denial of Service vulnerability that can lead to device service disruptions. The root cause details are not explicitly enumerated beyond the Do...

CVE-2022-42003

The CVE-2022-42003 issue affects FasterXML jackson-databind, where enabling UNWRAP_SINGLE_VALUE_ARRAYS allows resource exhaustion due to a missing check in primitive value deserializers to prevent deep wrapper array nesting. Affected versions are before 2.13.4.1 and 2.12.17.1; remediation per sou...

CVE-2019-5736

CVE-2019-5736 affects runc as shipped in Docker before 18.09.2 and other products, enabling a container to overwrite the host runc binary via /proc/self/exe and gain host root. Root cause: file-descriptor mishandling in runc leading to command execution as root inside a container. Affected versio...

CVE-2023-36728

CVE-2023-36728 is a Denial-of-Service vulnerability impacting Microsoft SQL Server components. Public references in the supplied documents describe DoS impact from a malformed TDS packet/login handling that can lead to unavailability or undefined behavior, as cited in the October 2023 security up...

CVE-2022-41091

CVE-2022-41091 is a Windows security feature bypass in Mark of the Web (MOTW). The vulnerability allows bypassing MOTW protections, with a CVSS v3.1 base score of 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L). Public sources note exploitation in the wild and patches are delivered via Microsoft’s upda...

CVE-2022-31628

CVE-2022-31628 affects PHP where the phar uncompressor can recursively uncompress quine gzip files, causing an infinite loop in affected builds. Public details show this affects PHP versions before 7.4.31, 8.0.24, and 8.1.11. The workaround/fix is to upgrade to the patched releases: PHP 7.4.31, 8...

CVE-2020-12801

CVE-2020-12801 affects LibreOffice 6.3.x prior to 6.3.6 and 6.4.x prior to 6.4.3. If an encrypted document crashes and is recovered, subsequent saves may default to unencrypted even when the document was encrypted, if the recovered file format is not the default ODF format. Public details in conn...

CVE-2026-29167

CVE-2026-29167 is a Use After Free vulnerability in Apache HTTP Server when using mod_ldap in per-directory configuration. The issue affects Apache HTTP Server versions 2.4.0 through 2.4.67. The CVSS base score is 9.8 (Network, N), with high impact on confidentiality, integrity, and availability....

CVE-2023-3341

CVE-2023-3341 describes a stack-exhaustion DoS in ISC BIND’s control channel; recursive parsing of control channel messages can overflow stack, causing named to terminate. Affected are BIND/NAMED versions across multiple series (e.g., 9.2.0–9.16.43, 9.18.0–9.18.18, 9.19.0–9.19.16, plus S1 variant...

CVE-2019-13567

CVE-2019-13567 affects the Zoom Client for macOS, prior to 4.4.53932.0709. The issue arises when the ZoomOpener daemon (a hidden local web server) is running but the Zoom Client is not installed or cannot be opened; an attacker can remotely execute code by using a maliciously crafted launch URL. ...

CVE-2019-6446

CVE-2019-6446 affects NumPy (pre-1.16.3) where the pickle module is used unsafely via numpy.load, allowing remote code execution with a crafted serialized object. The issue is noted as disputed by third parties who argue the behavior can be legitimate in loading trusted Python object arrays. Mult...

CVE-2021-35587

CVE-2021-35587 affects Oracle Access Manager (OpenSSO Agent) in Oracle Fusion Middleware. Affected versions: 11.1.2.3.0, 12.2.1.3.0, 12.2.1.4.0. The root cause is unauthenticated deserialization of untrusted data, enabling remote code execution and takeover of Oracle Access Manager. The connected...

CVE-2024-23897

CVE-2024-23897 affects Jenkins 2.441 and earlier, and LTS 2.426.2 and earlier. The root cause is an enabled args4j-based CLI feature (expandAtFiles) that replaces an @file path in CLI arguments with the file contents, enabling read access to arbitrary files on the Jenkins controller filesystem. P...

CVE-2013-2566

CVE-2013-2566 involves RC4 biases in TLS/SSL allowing plaintext-recovery via large volumes of sessions with the same plaintext. Multiple connected sources confirm this issue affecting products such as F5 BIG-IP (various modules) and IBM Proventia/SiteProtector family. Affected in some BIG-IP rele...

CVE-2020-25694

CVE-2020-25694 affects PostgreSQL clients/servers prior to versions 13.1, 12.5, 11.10, 10.15, 9.6.20 and 9.5.24. The issue allows a reconnection that downgrades security settings, enabling potential MITM or observation of clear-text transmissions, with impact to confidentiality, integrity, and av...

CVE-2013-1902

CVE-2013-1902 concerns PostgreSQL versions 8.3.x before 8.3.23, 8.4.x before 8.4.17, 9.0.x before 9.0.13, 9.1.x before 9.1.9, and 9.2.x before 9.2.4, which generate insecure temporary files with predictable filenames. The description notes an unspecified impact and attack vectors related to graph...

CVE-2008-0043

CVE-2008-0043 concerns Apple iPhoto prior to 7.1.2. The issue is a format string vulnerability in photocast subscriptions that could allow a remote attacker to execute arbitrary code on the affected host. The vulnerability affects iPhoto’s handling of photocast subscriptions, with the NVD listing...

CVE-2024-23953

CVE-2024-23953 affects Apache Hive (LLAP); uses Arrays.equals() in LlapSignerImpl to compare signatures, introducing a timing discrepancy that can enable signature forgery by an authorized user. The issue stems from non-constant-time comparison, where mismatched bytes may reveal information throu...

CVE-2021-4183

Wireshark: CVE-2021-4183 is a denial-of-service issue caused by a crash in the pcapng file parser in Wireshark 3.6.0. Public documentation in connected advisories (Gentoo GLSA 202210-04, openSUSE/openSUSE-SU-2022:0375-1, SUSE/SLES updates, etc.) confirms the vulnerability condition is the pcapng ...

CVE-2021-21974

CVE-2021-21974 is a heap-based overflow in VMware ESXi’s OpenSLP service that can enable remote code execution when an attacker on the same network segment can reach port 427. Affected releases include ESXi 7.x (before ESXi70U1c-17325551), ESXi 6.7 (before 202102401-SG), and ES6.5 (before 2021021...