CVE-2023-43622

CVE-2023-43622 affects Apache HTTP Server via the mod_http2 implementation. An attacker opening an HTTP/2 connection with an initial window size of 0 could block handling of that connection indefinitely, potentially exhausting server worker resources in a pattern similar to the slow loris attack....

CVE-2022-24407

CVE-2022-24407 affects Cyrus SASL 2.1.17–2.1.27 (before 2.1.28); the SQL plugin (plugins/sql.c) fails to escape passwords in SQL INSERT/UPDATE, allowing a remote attacker to execute arbitrary SQL commands. This can enable privilege/escalation scenarios as described in vendor advisories. The mitig...

CVE-2021-44026

CVE-2021-44026 concerns Roundcube Webmail, where versions prior to 1.3.17 and 1.4.x prior to 1.4.12 are vulnerable to SQL injection via search or search_params. The issue is documented in multiple advisories and CVE trackers, with Debian and Fedora indicating fixes in 1.2.3+dfsg.1-4+deb9u9 / 1.4....

CVE-2020-8622

CVE-2020-8622 pertains to ISC BIND and causes an assertion failure leading to a server exit when processing a truncated TSIG-signed response. The vulnerability can be triggered by an attacker on the network path or by exploiting a server receiving a TSIG-signed request, potentially harming availa...

CVE-2019-10768

CVE-2019-10768 affects AngularJS before 1.7.9. The function merge() could be tricked into adding or modifying properties of Object.prototype via a proto payload, enabling prototype pollution. IBM/X-Force data in connected docs corroborates the vulnerability and the CVSS metrics (base scores 7.3 i...

CVE-2022-24860

Databasir 1.01 contains a hard-coded cryptographic key vulnerability that lets an attacker generate login credentials for any user and access the backend service at different IP addresses. This is described across multiple sources (NVD description, Red Hat entry, CVE listings) as a use of hard-co...

CVE-2019-11039

CVE-2019-11039 – PHP iconv_mime_decode_headers out-of-buffer read Description: The vulnerability arises in PHP’s MIME header parsing in function iconv_mime_decode_headers(), vulnerable versions include PHP 7.1.x < 7.1.30, 7.2.x < 7.2.19, and 7.3.x

CVE-2022-33891

Summary: CVE-2022-33891 is a command-injection vulnerability in the Apache Spark UI when ACLs are enabled. A code path in HttpSecurityFilter can impersonate by supplying an arbitrary username, leading to an arbitrary shell command being executed as the Spark process user. Affected versions includ...

CVE-2026-21962

CVE-2026-21962 – Oracle HTTP Server / WebLogic Proxy Plug‑in is documented as a critical, unauthenticated vulnerability affecting Oracle HTTP Server and WebLogic Proxy Plug‑in components. Affected versions include Oracle HTTP Server and WebLogic Proxy Plug‑in for Apache HTTP Server: 12.2.1.4.0, 1...

CVE-2024-0056

CVE-2024-0056 affects Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider security feature bypass. CVSS v3.1 base score 8.7 (NETWORK, HIGH impact on confidentiality and integrity, no availability impact) per Microsoft, with CVSS v4 score 8.8 indicating high impact. Descriptions i...

CVE-2010-3904

CVE-2010-3904 is a Linux kernel flaw in the RDS implementation where rds_page_copy_user does not validate user-space addresses, enabling local privilege escalation via crafted sendmsg/recvmsg calls. Affected: Linux kernels prior to 2.6.36; fixed in later kernel releases (e.g., Red Hat/CentOS advi...

CVE-2025-21502

CVE-2025-21502 affects Oracle Java SE and related GraalVM packages (Hotspot) across multiple supported versions (Java SE 8u431-perf, 11.0.25, 17.0.13, 21.0.5, 23.0.1; GraalVM JDK 17.0.13/21.0.5/23.0.1; GraalVM EE 20.3.16/21.3.12). The described vulnerability allows an unauthenticated, network-acc...

CVE-2023-41053

CVE-2023-41053 affects Redis 7.0+ where SORT_RO can bypass ACL checks, potentially exposing keys not authorized by the ACL. The root cause is improper key identification for SORT_RO, enabling access to non-permitted keys under existing ACLs. Documented impact is an ACL bypass with local access re...

CVE-2018-20783

CVE-2018-20783 affects PHP’s PHAR extension. A heap-based buffer over-read occurs in PHAR reading functions when parsing a .phar file name, allowing memory past the actual data to be read. Affected versions include PHP <5.6.39, 7.x <7.0.33, 7.1.x <7.1.25, and 7.2.x

CVE-2023-35311

Technical details about CVE-2023-35311 are not publicly available in the provided connected documents. The sources confirm a Microsoft Outlook security feature bypass but do not specify root cause, affected versions, or fixes. Monitor for updates.

CVE-2022-26833

The CVE-2022-26833 issue affects Open Automation Software OAS Platform V16.00.0121. A vulnerability in the REST API allows unauthenticated use via a crafted sequence of HTTP requests, stemming from improper authentication. Consequences cited in the sources include unauthenticated access to the RE...

CVE-2023-29357

CVE-2023-29357 is a Microsoft SharePoint Server Elevation of Privilege vulnerability. The root cause is an incorrect authentication implementation that allows an unauthenticated attacker to spoof JWT authentication tokens, enabling them to execute with administrator privileges on affected SharePo...

CVE-2019-11040

CVE-2019-11040 describes a heap/buffer over-read in PHP’s EXIF extension during EXIF data parsing (exif_read_data()). Affected are PHP 7.1.x < 7.1.30, 7.2.x < 7.2.19, and 7.3.x

CVE-2026-56155

CVE-2026-56155 affects Active Directory Federation Services (AD FS) with insufficient granularity in access control, enabling an authorized local attacker to escalate privileges. Documents indicate a Privilege Escalation impact and note updates have been released by Microsoft to address the vulne...

CVE-2026-32933

AutoMapper (a .NET object-object mapper) is vulnerable in versions prior to 15.1.1 and 16.1.1 to a Denial of Service via uncontrolled recursion during deep object graph mapping, which can exhaust thread stack memory and trigger a StackOverflowException, terminating the process. The issue is mitig...

CVE-2025-29926

CVE-2025-29926 affects XWiki Platform via the WikiManager REST API. In affected releases before fixes, any user could create a new wiki, potentially granting the user administrator privileges and enabling further farm-wide attacks. The REST API is not included in XWiki Standard by default and mus...

CVE-2022-23451

CVE-2022-23451 concerns openstack-barbican. The issue is an authorization flaw where default secret-metadata API policy allows any authenticated user to add/modify/delete metadata on any secret, compromising ownership and enabling denial of service by resource consumption. The impact is described...

CVE-2021-20325

CVE-2021-20325 documents a Red Hat-specific security regression for Apache HTTP Server in Red Hat Enterprise Linux 8.5.0. The issue arises from missing fixes for CVE-2021-40438 and CVE-2021-26691 in the 8.5.0 httpd packages, making new 8.5.0 installations susceptible to those CVEs (while upstream...

CVE-2021-43527

CVE-2021-43527 describes a heap overflow in NSS when handling DER-encoded DSA or RSA-PSS signatures. The vulnerability affects NSS versions prior to 3.73 (and 3.68.1 ESR for some configurations) and can impact applications using NSS for signatures in CMS, S/MIME, PKCS#7, or PKCS#12, as well as th...

CVE-2019-11038

CVE-2019-11038 affects the GD Graphics Library (LibGD) 2.2.5 as used in the PHP gd extension. The flaw arises in gdImageCreateFromXbm(), where input data can cause the function to use an uninitialized variable, potentially leaking contents from stack memory. Affected PHP branches are 7.1.x below ...

CVE-2026-21509

CVE-2026-21509 is a Microsoft Office security feature bypass triggered by reliance on untrusted inputs in a security decision, enabling a local attacker to bypass OLE protections after a user opens a crafted document. Affected products include Office 2016, 2019, LTSC 2021/2024 and Microsoft 365 A...

CVE-2024-35085

CVE-2024-35085 affects J2EEFAST v2.7.0; a SQL injection exists in the findPage function of ProcessDefinitionMapper.xml due to insufficient input validation. Exploitation could allow an attacker to execute arbitrary SQL to access data, per multiple sources (CNVD/CNNVD, Red Hat, NVD). There is no c...

CVE-2022-48174

CVE-2022-48174 is a stack overflow in BusyBox ash.c:6030 affecting versions before 1.35. In Internet of Vehicles contexts this can enable arbitrary code execution from a crafted input command. Public details confirm the vulnerability in BusyBox prior to 1.35 and indicate exposure in IoT environme...

CVE-2022-23121

CVE-2022-23121 is a Netatalk remote code execution vulnerability (root context) caused by improper error handling in AppleDouble parsing in parse_entries. The issue is part of multiple Netatalk flaws (e.g., CVE-2022-23122, CVE-2022-23123, CVE-2022-23124, CVE-2022-23125) affecting 3.1.x releases; ...

CVE-2019-5527

CVE-2019-5527 is a use-after-free in the virtual sound device affecting VMware ESXi, Workstation, Fusion, VMRC and Horizon Client. The issue allows a local attacker with low privileges on a guest to potentially execute code on the host, with impact on confidentiality, integrity and availability d...

CVE-2019-10638

The CVE-2019-10638 entry concerns the Linux kernel IT: the IP ID values used for connectionless protocols (UDP/ICMP) in kernels prior to 5.1.7. The underlying issue is weak hashing of IP IDs, enabling an attacker to track a host across networks by correlating IDs and potentially obtain the hashin...

CVE-2024-31621

CVE-2024-31621 affects Flowise Flowise v1.6.2 and earlier, with multiple sources describing an authentication bypass (notably in Flowise = 1.6.6 / 1.8.1+ per other reports). If exploitation details are present, they confirm remote code execution via /api/v1; otherwise, exploitation specifics are ...

CVE-2022-28464

CVE-2022-28464 affects Apifox up to version 2.1.6. The issue is a Cross Site Scripting (XSS) vulnerability that can lead to remote code execution. The connected documents consistently describe XSS as the root cause in Apifox’s web context, implying that attacker-controlled input may be processed ...

CVE-2020-10745

CVE-2020-10745 affects Samba (notably AD DC) and is caused by abuse of compression in replies to NetBIOS over TCP/IP name resolution and DNS packets, leading to excessive CPU usage and a denial of service. The vulnerability impacts Samba versions prior to 4.10.17, 4.11.11, and 4.12.4. Remediation...

CVE-2022-45179

LIVEBOX Collaboration vDesk (through v031) has a basic XSS vulnerability in the /api/v1/vdeskintegration/todo/createorupdate endpoint via the title parameter, and in /dashboard/reminders. A remote authenticated user can inject arbitrary HTML into the reminder title, potentially corrupting the pag...

CVE-2023-32315

Openfire (Ignite Realtime) is affected by a path traversal vulnerability in the web-based Admin Console exposed via the unauthenticated Setup Environment, permitting access to admin pages in an already configured Openfire instance. Affected versions are Openfire releases since April 2015 starting...

CVE-2022-41903

CVE-2022-41903 describes a heap-write overflow in Git during commit formatting when processing padding operators in pretty.c (format_and_pad_commit), where a size_t is mishandled as an int and added to memcpy() offsets. This can be triggered by commands using --format (e.g., git log) or indirectl...

CVE-2021-23343

CVE-2021-23343 affects the path-parse package. The vulnerability is a Regular Expression Denial of Service (ReDoS) via the regexes splitDeviceRe, splitTailRe, and splitPathRe. The ReDoS has polynomial worst-case time complexity. Connected telemetry from MiracleLinux AXSA advisories lists path-par...

CVE-2020-7060

CVE-2020-7060: In PHP mbstring mbfl_filt_conv_big5_wchar, crafted data can read past the allocated buffer, causing information disclosure or crash. Affected: PHP 7.2.x < 7.2.27, 7.3.x < 7.3.14, 7.4.x

CVE-2019-18217

ProFTPD vulnerability CVE-2019-18217 causes remote unauthenticated Denial of Service due to improper handling of overly long commands, leading a child process to enter an infinite loop in main.c. Affected versions include 1.3.6b and 1.3.7rc before 1.3.7rc2; exploitation could impact availability ...

CVE-2017-1000251

CVE-2017-1000251 affects the Linux kernel Bluetooth subsystem (BlueZ) in L2CAP processing, causing a stack buffer overflow when handling configuration responses. Affected range includes kernels from 2.6.32 up to 4.13.1. Exploitation could crash the system or, in some deployments, allow remote cod...

CVE-2014-3583

CVE-2014-3583 affects Apache HTTP Server 2.4.10 and earlier, where the handle_headers function in mod_proxy_fcgi.c can be triggered by long response headers to cause a denial of service (buffer over-read and daemon crash). The vulnerability stems from the proxy/Fcgi header handling in mod_proxy_f...

CVE-2025-26523

CVE-2025-26523 affects the RupeeWeb trading platform. The vulnerability arises from insufficient authorization controls on certain API endpoints that perform add and delete operations, enabling an authenticated remote attacker to modify information belonging to other user accounts. Documented imp...

CVE-2022-27191

CVE-2022-27191 affects the golang.org/x/crypto/ssh package. Exploitable impact described in connected advisories: an attacker could crash a server under certain AddHostKey conditions. The vulnerability is tied to the x/crypto/ssh code path, with older Go crypto/ssh releases prior to 0.0.0-2022031...

CVE-2021-22570

CVE-2021-22570 affects Protocol Buffers (protobuf). A null character in a proto symbol is parsed incorrectly, causing a null pointer dereference via an unchecked access to the proto file name during error message generation. The issue can enable denial of service or memory access instability as d...

CVE-2022-29917

CVE-2022-29917 involves memory-safety bugs in Firefox 99 and Firefox ESR 91.8 (Mozilla Fuzzing Team). Some bugs showed memory corruption and, with enough effort, could be exploited to run arbitrary code. affected products include Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox

CVE-2022-29165

CVE-2022-29165 affects Argo CD (GitOps tool for Kubernetes). Vulnerable in versions starting at 1.4.0 and prior to 2.1.15, 2.2.9, and 2.3.4. If anonymous access is enabled, unauthenticated attackers can impersonate any Argo CD user or role (including built‑in admin) by sending a crafted JWT, pote...

CVE-2019-16056

CVE-2019-16056 : Debian LTS advisories fix a vulnerability in the Python email module where addresses containing multiple @ characters can bypass checks on From/To headers, potentially causing an application to accept an invalid address. The issue affects Python 2.7 as documented in DLA-2337-1 an...

CVE-2023-36805

Technical details for CVE-2023-36805 are not publicly provided in the supplied documents. Monitor for updates from official advisories.

CVE-2021-33033

The connected sources confirm CVE-2021-33033 affects the Linux kernel up to 5.11.14, with a use-after-free in cipso_v4_genopt (net/ipv4/cipso_ipv4.c) due to mishandled CIPSO/CALIPSO DOI refcounting, enabling writing an arbitrary value. Exploitation would be local. Remediation is to upgrade to a f...