CVE-2024-24919

CVE-2024-24919 is a zero-day-like vulnerability in Check Point Security Gateways (Remote Access VPN/Mobile Access blades) allowing unauthenticated remote readers to fetch arbitrary files via path traversal (e.g., aCSHELL/../../../../../../../etc/shadow). Public PoCs and in-the-wild mentions exist...

CVE-2023-42754

CVE-2023-42754 is a vulnerability in the Linux kernel IPv4 stack: a NULL pointer dereference where skb may not be bound to a device before __ip_options_compile if the skb is re-routed by ipvs. The impact is a local crash under CAP_NET_ADMIN. Public details in connected advisories reaffirm the iss...

CVE-2022-21664

CVE-2022-21664 concerns WordPress across multiple advisories. The issue arises from improper sanitization in a WordPress class, which could enable unintended SQL queries. The vulnerability is mitigated by WordPress patch 5.8.3, with older affected versions fixed via security releases back to 4.1....

CVE-2020-14765

An advisory indicates CVE-2020-14765 affects Oracle MySQL Server (Server: FTS) with affected versions 5.6.49 and prior, 5.7.31 and prior, and 8.0.21 and prior. The cited materials describe a vulnerability that can cause the MySQL Server to hang or crash (DoS) via network access, but the root caus...

CVE-2016-10735

CVE-2016-10735 affects Bootstrap 3.x prior to 3.4.0 and 4.x-beta prior to 4.0.0-beta.2, enabling cross-site scripting via the data-target attribute. This is a distinct issue from CVE-2018-14041. The vulnerability arises from improper handling of data-target, allowing injected scripts/HTML through...

CVE-2025-47967

CVE-2025-47967 affects Microsoft Edge (Chromium-based) for Android. The vulnerability arises from insufficient user interface warnings for dangerous operations, enabling an unauthorized attacker to perform a network spoofing attack. According to the CVE details, the impact is a partial integrity ...

CVE-2025-20631

A security vulnerability exists in the MediaTek MT7615/MT7622/MT7663/MT7915/MT7916/MT7981/MT7986 WLAN AP Driver due to an incorrect bounds check . This flaw leads to an out-of-bounds write , which can be exploited for local escalation of privilege without requiring additional execution privileges...

CVE-2021-46912

CVE-2021-46912 affects the Linux kernel where tcp_allowed_congestion_control was global/writable and leaked across net namespaces. The issue was that ipv4_net_table entries (tcp_available_congestion_control and tcp_allowed_congestion_control) had NULL data pointers and their proc handlers referen...

CVE-2023-2828

CVE-2023-2828 concerns the BIND 9 DNS server’s named component. The vulnerability stems from the cache-cleaning logic: when the resolver is queried for specific RRsets in a certain order, the configured max-cache-size can be exceeded, potentially causing memory exhaustion. Affected are multiple B...

CVE-2022-31027

CVE-2022-31027 affects the OAuthenticator/CILogonOAuthenticator used by JupyterHub. The root cause is that allowed_idps is validated only by email domain, not by IdP (provider) identity, allowing login via an alternate IdP with a @domained email (e.g., berkeley.edu) to bypass intended restriction...

CVE-2020-8015

CVE-2020-8015 is a local privilege-escalation in Exim packaging affecting openSUSE Factory exim versions prior to 4.93.0.4-3.1. The issue allows escalation from the mail user to root via a UNIX symbolic link (Symlink) following vulnerability. Remediation is to upgrade to Exim 4.93.0.4 or newer; S...

CVE-2026-47691

CVE-2026-47691 affects Netty up to versions 4.1.135.Final and 4.2.15.Final. The issue is in DnsResolveContext bailiwick validation for NS records, where an attacker controlling an authoritative subdomain server can poison the cache for parent domains (e.g., .co.uk). The code path in Authoritative...

CVE-2025-37727

CVE-2025-37727 affects Elasticsearch. The vulnerability involves insertion of sensitive information into log files when auditing requests to the reindex API, potentially leading to confidentiality loss under specific preconditions. The CVSS 3.1 score is 5.7 (Medium) with attack vector Adjacent, c...

CVE-2023-5363

CVE-2023-5363 : OpenSSL 3.0 and 3.1 are affected by a bug in key/IV length processing during EVP_Init_ex2/2 and EVP_CipherInit_ex2, where alterations to keylen/ivlen via OSSL_PARAM may not apply, causing truncation or overruns. This can yield non-unique IVs and, in CCM/GCM/OCB modes, potential lo...

CVE-2023-22068

CVE-2023-22068 affects Oracle MySQL Server (InnoDB). Affected: MySQL 8.0.34 and earlier, and 8.1.0. An attacker with network access via multiple protocols and high privileges can cause the server to hang or crash (DoS). No explicit exploitation details are provided beyond this claim. Remediation:...

CVE-2022-37967

CVE-2022-37967 is described in connected sources as a Samba-related Kerberos elevation-of-privilege flaw. The Alt Linux entry notes fixes for Samba 4.16 (4.16.8-alt1) and 4.17.x packages addressing CVE-2022-37966, CVE-2022-37967, and CVE-2022-38023, with the specific issue: a service account with...

CVE-2022-27926

Zimbra Collaboration (ZCS) 9.0 is affected by a reflected XSS in /public/launchNewWindow.jsp that allows unauthenticated attackers to execute arbitrary script or HTML via request parameters. The issue is confirmed across multiple sources (NVD/Nuclei/CISA KEV/CNVD) with the impact described as cli...

CVE-2021-29650

CVE-2021-29650 affects the Linux kernel prior to 5.11.11. The netfilter subsystem (net/netfilter/x_tables.c and include/linux/netfilter/x_tables.h) may omit a full memory barrier when a new table value is assigned, enabling a local attacker to trigger a DoS/panic in netfilter. The issue is docume...

CVE-2020-13934

CVE-2020-13934 affects multiple Apache Tomcat releases (8.5.1–8.5.56, 9.0.x, 10.0.x up to M6) where an h2c direct connection didn’t release the HTTP/1.1 processor after upgrading to HTTP/2, potentially causing OutOfMemoryError and denial of service. Public advisories across vendors and distributi...

CVE-2006-2568

UBB.threads vulnerability CVE-2006-2568 is a remote file inclusion in addpost_newpoll.php, where the thispath parameter is consumed by PHP include() without proper sanitization. Affected versions are UBB.threads 6.4 through 6.5.2 and 6.5.1.1 (trial). Exploitation can enable an attacker to view ar...

CVE-2026-54121

CVE-2026-54121 affects Active Directory Certificate Services (AD CS). Root cause: improper authorization allowing an authorized attacker to elevate privileges over the network. Impact: elevation of privilege with high CVSS (8.8) per Microsoft-assigned metrics. Remediation: Microsoft has released ...

CVE-2022-29130

Technical details about CVE-2022-29130 are not provided in the connected documents. Publicly available information in the initial entry is limited to high‑level descriptors; no product/version/impact/fix specifics are included here. Monitor for official updates.

CVE-2022-1011

CVE-2022-1011: A use-after-free vulnerability in the Linux kernel FUSE implementation when a user triggers write(), enabling local privilege escalation. Affected component is the FUSE filesystem in the kernel; impact is unauthorized access to data from FUSE mounts and potential escalation. Connec...

CVE-2021-34558

CVE-2021-34558 affects the Go crypto/tls implementation. In Go up to 1.16.5, the certificate public-key type is not properly validated for RSA-based key exchanges, allowing a TLS server to trigger a panic in the client. Several connected advisories link this to Go’s TLS handling and note remediat...

CVE-2024-12053

CVE-2024-12053 denotes a type confusion issue in V8 used by Google Chrome/Chromium, before version 131.0.6778.108. The vulnerability allows remote exploitation via a crafted HTML page, with a high impact across confidentiality, integrity, and availability, and requires user interaction and networ...

CVE-2023-21492

CVE-2023-21492 is a Samsung Mobile devices vulnerability where kernel pointers are printed to the log file, enabling a privileged, local attacker to bypass ASLR. Affected software relates to Samsung Mobile devices with the SMR May-2023 Release 1 context. The root cause is the insertion of sensiti...

CVE-2022-40765

The CVE-2022-40765 issue affects Mitel MiVoice Connect, specifically the Edge Gateway component, where insufficient restriction of URL parameters allows an authenticated attacker with internal network access to perform a command injection. Connected sources confirm an internal-network, authentica...

CVE-2019-17569

CVE-2019-17569: In Apache Tomcat, a regression from refactoring in 9.0.28–9.0.30, 8.5.48–8.5.50, and 7.0.98–7.0.99 caused invalid Transfer-Encoding header handling, enabling HTTP Request Smuggling behind a misconfigured reverse proxy. Connected advisories show mitigations: Amazon Linux 2 ALAS2TOM...

CVE-2018-19520

CVE-2018-19520 targets SDCMS 1.6 on PHP 5.x. The admin path app/admin/controller/themecontroller.php uses a check_bad function intended to block certain PHP functions (e.g., eval) but does not block preg_replace with the /e/ modifier, enabling an attacker with admin template access to execute arb...

CVE-2010-1256

CVE-2010-1256 is an IIS memory-corruption vulnerability (IIS 6.0/7.0/7.5) tied to Extended Protection for Authentication. A remote attacker could execute arbitrary code by abusing how authentication information is parsed, when Extended Protection is enabled (KB973917). Microsoft MS10-040 fixes th...

CVE-2023-4807

CVE-2023-4807 : OpenSSL POLY1305 MAC state corruption on Windows x64 with AVX512-IFMA. Affected: OpenSSL library used by server apps (e.g., TLS with CHACHA20-POLY1305). Root cause: POLY1305 MAC implementation does not save/restore non-volatile XMM registers on Windows 64 when MACing data beyond 6...

CVE-2022-27507

CVE-2022-27507 affects Citrix ADC and Citrix Gateway. Affected conditions require DTLS enabled and either HDX Insight for EDT traffic or SmartControl configured, leading to an authenticated denial-of-service. Vulnerable versions include Citrix ADC/Gateway 12.1 prior to 12.1-64.17, 13.0 prior to 1...

CVE-2022-36227

CVE-2022-36227 affects libarchive (before 3.6.2). The bug is a NULL pointer dereference caused by not checking the result of calloc, which can return NULL and lead to dereference. Some sources acknowledge that this could in rare circumstances permit arbitrary code execution if NULL is treated as ...

CVE-2017-17663

CVE-2017-17663 affects the htpasswd component of mini_httpd (before v1.28) and thttpd (before v2.28). The vulnerability is a buffer overflow that can be exploited remotely to achieve code execution. Connected advisories corroborate a remote-code-execution impact and note fixes in later thttpd rel...

CVE-2016-7250

CVE-2016-7250 affects Microsoft SQL Server 2014 SP1/ SP2 and 2016. The vulnerability arises from an improper cast of an unspecified pointer in the SQL RDBMS Engine, enabling remote authenticated users to escalate privileges via unknown vectors. The issue is part of MS16-136 family of fixes; the r...

CVE-2024-34351

Next.js SSRF in Server Actions (CVE-2024-34351) affects self-hosted deployments using Server Actions with redirects to a relative path starting with “/” when Host header can be manipulated. Affected: Next.js prior to 14.1.1 (fixed in 14.1.1). Public writeups and PoC references exist in connected ...

CVE-2022-1529

This vulnerability affects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and Thunderbird

CVE-2022-40897

CVE-2022-40897 affects Python setuptools (PyPA) prior to 65.5.1, enabling a Regular Expression Denial of Service (ReDoS) via HTML in crafted PackageIndex content (package_index.py). Affected component is setuptools; impact is DoS with potential availability disruption. Remediation shown across mu...

CVE-2022-25856

The CVE-2022-25856 entry affects the Argo Events project: the GitArtifactReader.Read() implementation in the sensors/artifacts code path (git.go) allows directory traversal, enabling an attacker to read arbitrary files when a path contains a symbolic link or an implicit directory (e.g., using ../...

CVE-2022-28162

CVE-2022-28162 affects Brocade SANnav before version 2.2.0. The root cause is logging the REST API authentication token in plain text, potentially exposing credentials. Affected products are Brocade SANnav deployments prior to 2.2.0. Remediation is to upgrade to SANnav 2.2.0 or later (per the Bro...

CVE-2021-45957

CVE-2021-45957 affects dnsmasq 2.86 with a heap-based buffer overflow in answer_request (invoked via fuzz_rfc1035.c and fuzzed paths). The vendor notes CVE-2021-45951 through CVE-2021-45957 “do not represent real vulnerabilities.” Nessus unpatched entries corroborate that patches may not be avail...

CVE-2019-25013

CVE-2019-25013 affects the GNU C Library (glibc) iconv, where processing invalid multi-byte input in EUC-KR can cause a buffer over-read. Connected advisories confirm the issue and map it to glibc versions affected (through 2.32) and note that Debian, AlmaLinux/Alma or Amazon Linux advisories add...

CVE-2020-10696

CVE-2020-10696 involves a path traversal flaw in Buildah prior to 1.14.5. The vulnerability could allow an attacker to trick a user building a container image from an HTTP(S) server into writing files to the host file system where the user has permissions. The provided connected docs corroborate ...

CVE-2019-14835

The CVE-2019-14835 entry describes a buffer overflow in Linux kernel vhost functionality (virtqueue buffers translated to IOVs) during VM live migration. A privileged guest user could pass descriptors with invalid length while migration is underway, potentially causing a host privilege escalation...

CVE-2017-11103

CVE-2017-11103 affects Heimdal (Kerberos); vulnerability arises from improper handling of the KDC-REP service name in krb5_extract_ticket, enabling remote service impersonation when the unencrypted service name is used instead of the encrypted enc_part. Apple’s security content (HT208112/HT208221...

CVE-2012-2705

The CVE-2012-2705 entry concerns the Drupal Smart Breadcrumb module (6.x-1.x) prior to 6.x-1.3. The root cause is that filter_titles() fails to properly filter user-supplied titles to plain-text, enabling cross-site scripting (XSS) by remote authenticated users who have create or edit node permis...

CVE-2026-42055

CVE-2026-42055 affects NGINX Plus and NGINX Open Source via the ngx_http_proxy_v2_module and ngx_http_grpc_module. A remote, unauthenticated attacker can exploit scenarios where proxy_http_version 2 or grpc_pass is used, ignore_invalid_headers is off, and large_client_header_buffers is set to mul...

CVE-2022-39260

Git Shell command-argument parsing bug (CVE-2022-39260) in pre-2.30.6…2.37.4 allows an attacker with SSH access to a Git shell login to overflow an int-based count when building the argv array, enabling arbitrary heap writes and potential remote code execution via execv(). Affected setups require...

CVE-2020-7608

CVE-2020-7608 affects the yargs-parser package and enables prototype pollution via a proto payload, allowing modification of Object.prototype. Public data notes local/remote impact depending on the environment, with CVSS vectors indicating low-to-medium base severity (NVD CVSS v3.1: 5.3, LOCAL, L...

CVE-2018-6353

Technical details about CVE-2018-6353 are not provided in the supplied documents. No affected versions, root cause, impact, or remediation are specified here. Monitor for official advisories or vendor/security feeds for updates.