CVE-2025-22457

CVE-2025-22457 is a stack-based buffer overflow in Ivanti Connect Secure family (affecting Ivanti Connect Secure prior to 22.7R2.6, Ivanti Policy Secure prior to 22.7R1.4, and Ivanti ZTA Gateways prior to 22.8R2.2) that enables remote code execution by a remote unauthenticated attacker. Affected ...

CVE-2024-43572

CVE-2024-43572 is a Microsoft Windows Management Console Remote Code Execution vulnerability. Connected sources confirm a patch was released in the October 2024 updates, and Microsoft/Elastic Security Labs notes mitigations such as blocking untrusted MSC files to prevent code execution via MMC. T...

CVE-2024-26585

Technical details for CVE-2024-26585 are not provided in the supplied connected documents. Public specifics (affected products, impact, and fixes) should be sought from official advisories and vendor notices.

CVE-2024-0056

CVE-2024-0056 affects Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider security feature bypass. CVSS v3.1 base score 8.7 (NETWORK, HIGH impact on confidentiality and integrity, no availability impact) per Microsoft, with CVSS v4 score 8.8 indicating high impact. Descriptions i...

CVE-2023-31474

GL.iNet devices before 3.216 are affected by CVE-2023-31474 due to a flaw in the software installation feature that lets an attacker inject arbitrary parameters via a regex in a package name, causing opkg to list files in a target directory. The issue stems from how package-name regex handling ca...

CVE-2022-2795

CVE-2022-2795 is a DNS resolver vulnerability in BIND where flooding the resolver with specific queries can cause a denial of service by severely degrading resolver performance. The issue is associated with the BIND 9 series (notably 9.16.x, 9.18.x, and 9.19.x branches in various advisories) and ...

CVE-2022-24848

DHIS2 SQL Injection (CVE-2022-24848) affects the API endpoint /api/programs/orgUnits?programs= for DHIS2 versions prior to 2.36.10.1 and 2.37.6.1. The vulnerability requires the attacker to be logged in as a DHIS2 user and could allow reading, editing, or deleting data in the instance’s database....

CVE-2019-13030

The CVE-2019-13030 entry concerns the eQ-3 Homematic CCU3 AddOn “Mediola NEO Server for Homematic CCU3” vulnerable before version 2.4.5. The root cause is improper access control on addon configuration pages and a missing check in rc.d/97NeoServer, allowing an unauthenticated admin to start/stop ...

CVE-2018-20148

CVE-2018-20148 affects WordPress versions prior to 4.9.9 and 5.x prior to 5.0.1. The issue stems from mishandling of serialized data at phar:// URLs in wp-includes/post.php: wp_get_attachment_thumb_file can mishandle metadata and lead to PHP object injection via crafted wp.getMediaItem XMLRPC cal...

CVE-2023-24540

CVE-2023-24540 targets improper handling of JavaScript whitespace in templates, with exploitation linked to Go’s html/template and related Go stdlib packages (and broader Go toolchain components). The initial entry shows a critical CVSS v3.1 score (9.8) with network access, no user interaction, a...

CVE-2022-30129

CVE-2022-30129 – Visual Studio Code Remote Code Execution is a published vulnerability involving a failure to properly filter externally entered data during code construction, enabling a remote attacker to execute arbitrary code on the affected Visual Studio Code instance. The issue is described ...

CVE-2022-25787

The CVE concerns Secomea GateManager, specifically its LMM API: Information Exposure Through Query Strings in GET requests can leak information via the GATE LMM API, allowing a local attacker (or an admin) to hijack connections. Affected are all GateManager versions prior to 9.7. The root cause i...

CVE-2020-2551

CVE-2020-2551 affects Oracle WebLogic Server (WLS Core Components) on versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. The issue is a deserialization vulnerability in the IIOP protocol that allows an unauthenticated, network-remote attacker to take over the WebLogic Server. The CVSS 3....

CVE-2022-24990

TerraMaster NAS (TOS) versions 4.2.29 and earlier are vulnerable to unauthenticated remote command execution (RCE) and information disclosure. The root cause is improper input validation in the webNasIPS component within the api.php script, specifically involving PHP Object Instantiation . Remote...

CVE-2022-20007

The CVE-2022-20007 issue is a race-condition vulnerability in Android's RootWindowContainer.java (startActivityForAttachedApplicationIfNeeded) that could allow an overlay to fool a foreground app, enabling local privilege escalation. Affected: Android 10–12 (including 12L). Root cause: a race bet...

CVE-2022-0492

CVE-2022-0492 is a Linux kernel local-privilege-escalation flaw in the cgroups v1 release_agent handling (function cgroup_release_agent_write in kernel/cgroup/cgroup-v1.c). The issue arises because releasing the release_agent does not enforce proper capabilities, enabling a local attacker to esca...

CVE-2008-4250

The CVE-2008-4250 issue is a remote code execution vulnerability in the Windows Server Service. The root cause is a buffer/overflow in the path canonicalization logic (triggered via crafted RPC requests to NetAPI32/Server Service), affecting Windows versions listed in the entry (e.g., Windows 200...

CVE-2018-1160

Netatalk before 3.1.12 is vulnerable to an out-of-bounds write in dsi_opensess.c due to missing bounds checking on attacker-controlled data. A remote unauthenticated attacker could achieve arbitrary code execution (potentially with root privileges). Public exploit activity exists (authentication ...

CVE-2011-3348

The CVE-2011-3348 issue affects the Apache HTTP Server’s mod_proxy_ajp in combination with mod_proxy_balancer, where certain configurations allow remote attackers to trigger a denial of service by sending a malformed HTTP request. The vulnerability is described as causing a temporary error state ...

CVE-2009-1890

CVE-2009-1890 affects Apache HTTP Server when used as a reverse proxy. The mod_proxy_http.c mechanism can fail to correctly bound a stream when Content-Length is exceeded, causing a denial-of-service via CPU exhaustion from crafted requests. The issue is specific to the reverse-proxy path in mod_...

CVE-2023-36434

Technical details about CVE-2023-36434 are not provided in the connected documents. The materials mention the vulnerability in Windows IIS (Elevation of Privilege) but do not disclose affected products, root cause, exploit info, or fixes. Monitor for updates.

CVE-2022-22302

CVE-2022-22302 affects FortiGate versions 6.0.0–6.0.13, 6.2.0–6.2.9, and 6.4.0–6.4.1, plus FortiAuthenticator 5.5.0 and all 6.0/6.1 FortiAuthenticator releases. The issue is a clear-text storage of sensitive information (CWE-312) that may let a local unauthorized user retrieve private keys used f...

CVE-2022-45177

LIVEBOX Collaboration vDesk (through v031) is affected. A vulnerability described as an Observable Response Discrepancy occurs on /api/v1/vdeskintegration/user/isenableuser, /api/v1/sharedsearch?search={NAME]+{SURNAME], and /login, where the web app reveals internal state information to unauthori...

CVE-2023-29357

CVE-2023-29357 is a Microsoft SharePoint Server Elevation of Privilege vulnerability. The root cause is an incorrect authentication implementation that allows an unauthenticated attacker to spoof JWT authentication tokens, enabling them to execute with administrator privileges on affected SharePo...

CVE-2022-37706

CVE-2022-37706 is a local privilege-escalation in Enlightenment where enlightenment_sys is setuid root and mishandles pathnames starting with /dev/.., allowing a local user to gain root privileges. Affected: Enlightenment before 0.25.4 (enlightenment_sys binary). Root cause: insecure handling of ...

CVE-2022-44708

CVE-2022-44708 is a Microsoft Edge (Chromium-based) Elevation of Privilege vulnerability. The initial document lists Edge Chromium-based Elevation of Privilege (CVE-2022-44708) with a CVSS v3.1 base score of 8.3 (High), attack vector Network, attack complexity High, privileges required None, user...

CVE-2024-7347

NGINX/Open Source and Plus are vulnerable when built with ngx_http_mp4_module and the mp4 directive is used; a specially crafted MP4 file can over-read worker memory, potentially terminating the process. Affected versions vary by distribution; several advisories indicate patches are available. Fo...

CVE-2023-0216

CVE-2023-0216 : OpenSSL contains an invalid pointer dereference on read when an application loads malformed PKCS7 data via d2i_PKCS7(), d2i_PKCS7_bio(), or d2i_PKCS7_fp(). This can cause an application crash and potentially a denial of service. The description notes that the TLS implementation it...

CVE-2019-16168

CVE-2019-16168 affects SQLite up to version 3.29.0, whereLoopAddBtreeIndex in sqlite3.c may crash a browser/application due to missing validation of sqlite_stat1 sz, described as a severe division by zero in the query planner. Connected documents show multiple advisories referencing the fix in SQ...

CVE-2026-62911

Technical details (affected software, vulnerable component, root cause, and fixes) are not publicly available in the provided documents. Monitor for updates.

CVE-2026-4519

CVE-2026-4519 affects the Python webbrowser.open() API, where URLs with a leading dash could be treated as command‑line options by certain browsers. The published CVE description shows that the new behavior rejects leading dashes and recommends sanitizing URLs before passing them to webbrowser.op...

CVE-2023-0465

CVE-2023-0465 is an OpenSSL certificate policy handling flaw where non-default policy checks are bypassable, allowing invalid certificate policies to pass verification. Connected entries confirm broader impact on Brocade Fabric OS (all versions) and describe remediation: OpenSSL/OpenSSL-based pro...

CVE-2022-34169

CVE-2022-34169 affects the Apache Xalan Java XSLT library. It describes an integer truncation vulnerability when processing malicious XSLT stylesheets, which can corrupt Java class files generated by the internal XSLTC compiler and allow execution of arbitrary Java bytecode. Public references in ...

CVE-2023-24534

Summary : CVE-2023-24534 describes a memory-exhaustion DoS in Go’s HTTP/MIME header parsing due to excessive memory allocation for certain inputs. The fix reduces allocation to only what is needed for parsed headers. What is affected (from connected documents) : multiple advisories indicate Go pa...

CVE-2022-24748

CVE-2022-24748 affects Shopware: before version 6.4.8.2, an improper API route check allows modifying customers and creating orders without App Permission. Root cause: inadequate authorization in API routing. Impact: unauthorized actions with no privileges; no exploitation details provided in the...

CVE-2021-25370

CVE-2021-25370 is a Samsung-internal chain of three vulnerabilities fixed in SMR Mar-2021 Release 1. The final issue is a use-after-free in the Display Processing Unit (DPU) driver that allows memory corruption leading to kernel panic when a file descriptor is mishandled in the DPU path. The thre...

CVE-2022-27664

CVE-2022-27664 affects Go’s net/http implementation: HTTP/2 connections can hang during closing when shutdown is preempted by a fatal error in Go versions prior to 1.18.6 and 1.19.x prior to 1.19.1, enabling denial of service. Affected component: net/http/HTTP2 handling. Impact described as a den...

CVE-2022-23652

Capsule-proxy (the reverse proxy for Capsule Operator) is affected. In versions prior to 0.2.1, an attacker with proper authentication can send a malicious Connection header to escalate privileges toward the Kubernetes API Server, exploiting the cluster-admin role bound to capsule-proxy. Multiple...

CVE-2022-23521

CVE-2022-23521 affects Git. The issue arises from parsing gitattributes, where very large path patterns or attribute names can trigger integer overflows, leading to arbitrary heap reads/writes and potentially remote code execution. Git’s handling of long lines (>2KB) in gitattributes (from fil...

CVE-2022-27510

The vulnerability CVE-2022-27510 allows unauthorized access to Gateway user capabilities in Citrix Gateway and Citrix ADC products. The root cause is an authentication bypass using an alternate path or channel (CWE-288 ). This issue specifically affects appliances configured as a Gateway (support...

CVE-2022-23722

PingFederate Password Reset vulnerability (CVE-2022-23722): when the password-reset mechanism uses the Authentication API with an Authentication Policy, email OTP, PingID, or SMS, an existing user can reset another user’s password. The connected sources describe the issue and its impact but do no...

CVE-2023-4408

The CVE-2023-4408 issue is a vulnerability in the DNS message parsing of BIND's named where the parsing path has an overly high computational complexity. A crafted large or malformed DNS message can cause high CPU usage on affected BIND 9 releases, potentially impacting both authoritative servers...

CVE-2022-24847

The OSGeo GeoServer software is vulnerable to an unchecked JNDI lookup due to improper input validation. An attacker with admin rights can exploit this via the GeoServer GUI or REST API to perform class deserialization , potentially resulting in arbitrary code execution . This flaw also affects t...

CVE-2025-20333

CVE-2025-20333 affects Cisco Secure Firewall ASA/FTD VPN web server. The issue stems from improper validation of HTTP(S) input in VPN requests, allowing an authenticated remote attacker with VPN credentials to execute arbitrary code as root and potentially fully compromise the device. A related v...

CVE-2025-0110

CVE-2025-0110 refers to a command-injection vulnerability in Palo Alto Networks PAN-OS OpenConfig Plugin, exploitable by an authenticated administrator who can issue gNMI requests to the management web interface. The commands run as the __openconfig user (Device Administrator) on the firewall, by...

CVE-2022-25237

CVE-2022-25237 concerns Bonita Web 2021.2. An authentication/authorization bypass occurs due to an overly broad exclude pattern in the RestAPIAuthorizationFilter. By appending ;i18ntranslation or /../i18ntranslation/ to the end of a URL, users with no privileges can access privileged API endpoint...

CVE-2022-26809

A critical Remote Code Execution vulnerability exists in the Microsoft Remote Procedure Call (RPC) Runtime library due to improper filtering of special elements in code segments constructed from external input data. An unauthenticated, remote attacker could exploit this flaw by sending a speciall...

CVE-2019-10639

CVE-2019-10639 affects Linux kernel 4.x (from 4.1) and 5.x prior to 5.0.8, enabling remote information exposure by deriving a KASLR kernel image offset from IP ID values for UDP/ICMP traffic. An attacker could force traffic to attacker-controlled IPs to obtain hashing key information and expose t...

CVE-2020-8622

CVE-2020-8622 pertains to ISC BIND and causes an assertion failure leading to a server exit when processing a truncated TSIG-signed response. The vulnerability can be triggered by an attacker on the network path or by exploiting a server receiving a TSIG-signed request, potentially harming availa...

CVE-2018-20676

CVE-2018-20676 affects Bootstrap 3.x up to 3.4.0, where XSS is possible via the tooltip data-viewport attribute due to unsafe handling of input. Affected component: tooltip data-viewport. Impact stated: cross-site scripting with potential partial integrity impact; no exploitation details provided...