CVE-2024-0985

Summary: CVE-2024-0985 describes a late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL that lets an object creator execute arbitrary SQL as the command issuer. The attack targets untrusted materialized views and can affect multiple PostgreSQL branches before fixed versions...

CVE-2023-0414

Wireshark CVE-2023-0414 describes a crash in the EAP dissector in Wireshark 4.0.0–4.0.2, allowing denial of service via packet injection or crafted capture files. Connected sources confirm this exact CVE and list it among other Wireshark issues; advisories and vendor notes indicate remediation by...

CVE-2022-22747

Summary: CVE-2022-22747 describes a denial of service caused by incorrect parsing of empty PKCS#7 sequences after accepting an untrusted certificate, leading to a crash. The vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird

CVE-2021-35005

CVE-2021-35005 relates to TeamViewer and is supported across multiple sources (NVD, Red Hat, ZDI, CNVD, etc.). The concrete technical detail: a local information-disclosure flaw in the TeamViewer service caused by improper validation of user-supplied data, leading to a read past the end of an all...

CVE-2020-14550

CVE-2020-14550 affects the MySQL Client (C API) in Oracle MySQL. Affected are 5.6.48 and earlier, 5.7.30 and earlier, and 8.0.20 and earlier. The vulnerability allows a low-privilege, network-accessible attacker via multiple protocols to cause a hang or a frequent, crashable DoS of the MySQL Clie...

CVE-2025-13193

Affects libvirt-based virtualization. CVE-2025-13193 causes external inactive snapshots for shut-down VMs to be world-readable, enabling information disclosure by unprivileged users. Public sources (Unity Linux UTSA-2025-993329; openSUSE openSUSE-SU-2025-20100-1; SUSE SUSE-SU-2026:0279-1) describ...

CVE-2022-42948

CVE-2022-42948 affects Cobalt Strike 4.7.1, due to improper escaping of HTML in Swing components, enabling remote code execution in the Cobalt Strike UI when crafted HTML is injected. The NVD indicates a critical CVSS v3.1 score (9.8) with network attack vector and no privileges/user interaction ...

CVE-2021-33164

CVE-2021-33164 is an Intel NUC BIOS/firmware vulnerability described as improper access control in BIOS firmware for certain Intel NUCs prior to INWHL357.0046, potentially allowing a locally privileged user to escalate privileges. The Red Hat advisory and Intel security advisory confirm the affec...

CVE-2022-3358

Summary: CVE-2022-3358 affects OpenSSL 3.0.0–3.0.5 and occurs when legacy custom ciphers are passed via EVP_CIPHER_meth_new() with NID_undef. The initialization functions EVP_EncryptInit_ex2()/EVP_DecryptInit_ex2()/EVP_CipherInit_ex2() may resolve to the NULL cipher from providers, causing plaint...

CVE-2022-34829

CVE-2022-34829 affects Zoho ManageEngine ADSelfService Plus (before 6203). A DoS can be triggered by a crafted payload to the Mobile App Deployment API, due to an input validation issue, leading to an application restart and partial availability impact. Public details across NVD/Red Hat/CNNVD ind...

CVE-2022-29474

Summary of CVE-2022-29474 (F5 BIG-IP iControl SOAP directory traversal) Vulnerability: A directory traversal in iControl SOAP allows an authenticated user with at least guest privileges to read wsdl files from the BIG-IP filesystem. Affected products/versions (as cited by multiple sources): BIG-I...

CVE-2021-44906

CVE-2021-44906 affects the minimist library, with versions listed as ≤ 1.2.5. The vulnerability is described as a Prototype Pollution issue via the file index.js, function setKey() (lines 69-95). The connected documents confirm this issue across multiple sources (e.g., Astra Linux advisory, CIRCL...

CVE-2021-43798

Grafana CVE-2021-43798 is a directory traversal vulnerability affecting Grafana 8.0.0-beta1 through 8.3.0 (excluding patched versions). The flaw allows access to local files via the vulnerable URL path /public/plugins/ and related API paths described in the advisories. Upstream fixes were release...

CVE-2019-10211

CVE-2019-10211 affects PostgreSQL Windows installers prior to 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24. Root cause: bundled OpenSSL (libeay32.dll) loads configuration from a hardcoded directory during SSL initialization, enabling a local attacker to execute arbitrary code with the calling process’s pr...

CVE-2017-5982

CVE-2017-5982 : Kodi Chorus2 add-on for Kodi (Chorus2 2.4.2) is affected by a directory traversal vulnerability. An unauthenticated remote attacker can read arbitrary files by supplying a crafted image path containing encoded traversal sequences (for example, image/image%3A//..%252fetc%252fpasswd...

CVE-2023-39192

CVE-2023-39192 : A flaw in the Linux kernel Netfilter xt_u32 module allows a local privileged attacker to trigger an out-of-bounds read by crafting improper values in the xt_u32 structure. The root cause is missing validation of fields in xt_u32, leading to crash or information disclosure. Impact...

CVE-2023-38595

CVE-2023-38595 is a WebKitGTK+ related vulnerability: processing web content may lead to arbitrary code execution. Connected advisories show affected packages as WebKitGTK/WebKitGTK+ (webkitgtk or webkitgtk4) across Linux distributions. Fixed versions vary by distro: Debian lists fixes in webkit2...

CVE-2023-28370

CVE-2023-28370 is an open redirect vulnerability in Tornado up to version 6.3.1 (and earlier) that can allow a remote unauthenticated user to redirect a victim to an arbitrary site via a crafted URL. Connected sources specify affected package Python-tornado and Tornado’s StaticFileHandler in cert...

CVE-2023-21967

CVE-2023-21967 affects Oracle Java SE and GraalVM Enterprise Edition (JSSE, Swing, Hotspot, Libraries) with multiple vulnerable versions including Java 8u361, 11.0.18, 17.0.6, 20 and GraalVM 20.3.9/21.3.5/22.3.1. Root cause is unresolved issues in the Java components allowing unauthenticated netw...

CVE-2020-8286

The CVE-2020-8286 issue affects curl/libcurl where OCSP responses were not verified correctly against the certificate, leaving room for fraudulent OCSP responses to appear valid and potentially bypass revocation checks. Reported range: curl versions 7.41.0 through 7.73.0. Impact phrasing in cited...

CVE-2019-10746

CVE-2019-10746 affects the nodejs mixin-deep module (versions before 1.3.2 and 2.0.0) and is due to prototype pollution: an attacker can use a constructor payload to add or modify properties on Object.prototype. Inffected ecosystems include applications reporting this vulnerability via Nessus/Mir...

CVE-2016-1286

CVE-2016-1286 affects ISC BIND 9.x (before 9.9.8-P4 and 9.10.x before 9.10.3-P4). A remote attacker can trigger a denial of service by sending a crafted DNS signature for a DNAME record, leading to an assertion failure in resolver.c or db.c and a named process crash. The issue is documented with ...

CVE-2009-3095

CVE-2009-3095 is a vulnerability in Apache httpd’s mod_proxy_ftp that allows remote authenticated attackers to bypass access restrictions and send arbitrary commands to an FTP server via crafted HTTP Authorization header vectors. The issue is part of a set of fixes for mod_proxy_ftp in the same a...

CVE-2024-38077

CVE-2024-38077 is a heap-based buffer overflow in the Windows Remote Desktop Licensing Service. The vulnerability occurs in CDataCoding::DecodeData() due to an incorrect calculation of the buffer size for Base64 data, enabling a remote attacker to trigger a heap overflow and achieve remote code e...

CVE-2024-30088

CVE-2024-30088 is a Windows Kernel TOCTOU race condition that can lead to local privilege escalation via AuthzBasepCopyoutInternalSecurityAttributes. Publicly discussed exploits and PoCs exist (Windows kernel LPE PoCs and Metasploit module), and CISA lists it as a known-exploited vulnerability; a...

CVE-2023-43788

CVE-2023-43788 affects libXpm. The vulnerability stems from a boundary condition in XpmCreateXpmImageFromBuffer(), enabling a local attacker to trigger an out-of-bounds read and read memory contents. Connected advisories confirm the issue across multiple distributions (e.g., AlmaLinux and related...

CVE-2022-33328

Robustel R1510 Web Server (3.3.0) suffers OS command injection in multiple AJAX endpoints. The TALOS summary details unsafe code paths using user-supplied parameters (e.g., /ajax/remove/, /ajax/config_rollback/, /ajax/remove_sniffer_raw_log/, /ajax/clear_tools_log/, /ajax/set_sys_time/), where fo...

CVE-2022-29214

CVE-2022-29214 affects NextAuth.js (next-auth). The vulnerability is an open redirect when implementing an OAuth 1 provider, present in versions prior to 3.29.3 (v3) and 4.3.3 (v4). A patch exists in those respective versions (3.29.3 and 4.3.3). If upgrading is not possible, a workaround is docum...

CVE-2022-29603

CVE-2022-29603 affects UniverSIS UniverSIS-API up to version 1.2.1. The SQL Injection is triggered via the $select parameter across multiple API endpoints (e.g., /api/students/me/messages/). A remote authenticated attacker could craft SQL statements to retrieve personal information or change grad...

CVE-2021-3572

The CVE-2021-3572 issue affects python-pip and stems from how it handles Unicode separators in git references, with the potential to cause a different revision to be installed in a repository. The vulnerability affects data integrity and is mitigated by upgrading to python-pip version 21.1, which...

CVE-2020-28007

Exim 4.x prior to 4.94.2 is affected by CVE-2020-28007, which allows local privilege escalation by exploiting a symlink/hard-link attack in the log directory where Exim runs as root and the directory is owned by a non-root user. The root-owned files can be overwritten from a local attacker, enabl...

CVE-2020-10756

CVE-2020-10756 is a concrete vulnerability in the QEMU SLiRP networking (libslirp) implementation. The issue is an out-of-bounds read in icmp6_send_echoreply() when replying to ICMP echo requests, enabling a guest to leak host memory and cause information disclosure. Affected component/version: l...

CVE-2018-1000808

CVE-2018-1000808 affects Python Cryptographic Authority pyopenssl prior to 17.5.0, describing a CWE-401 use-after-free in PKCS#12 Store handling that can lead to a Denial of Service when memory is constrained. The issue arises when loading/reloading certificates from PKCS#12, potentially triggere...

CVE-2006-1040

CVE-2006-1040 affects vBulletin versions 3.0.12 and 3.5.3. The vulnerability is a cross-site scripting (XSS) flaw where user-supplied content placed in the email field is injected into profile.php but not sanitized in sendmsg.php, enabling remote attackers to inject arbitrary web script or HTML t...

CVE-2025-5283

CVE-2025-5283 is a use-after-free in libvpx used by Google Chrome prior to 137.0.7151.55, enabling potential heap corruption via a crafted HTML page. The connected advisories confirm affected libraries and advise updating libvpx to a fixed release across affected distributions (e.g., library upda...

CVE-2022-48564

CVE-2022-48564 affects Python up to 3.9.1: read_ints in plistlib.py is vulnerable to a DoS via CPU/RAM exhaustion when processing malformed binary Apple Property List files. The impact is denial of service; exploitation details are not provided in the documents. Remediation is to apply the approp...

CVE-2023-38597

CVE-2023-38597 describes a vulnerability in processing web content that may lead to arbitrary code execution. The initial CVE page notes it is fixed in macOS Ventura 13.5 and Safari 16.6, iOS 15.7.8/iPadOS 15.7.8, and iOS 16.6/iPadOS 16.6. Connected documents corroborate broad WebKit/Kit GTK expo...

CVE-2019-20807

CVE-2019-20807 affects Vim prior to 8.1.0881, where a user can bypass the rvim restricted mode and run arbitrary OS commands via scripting interfaces (e.g., Python, Ruby, Lua). Affected product: Vim (Unix/Linux environments). Root cause: restricted-mode bypass enabling execution of external comma...

CVE-2019-1551

CVE-2019-1551 refers to an overflow bug in the x64_64 Montgomery squaring procedure used in OpenSSL during exponentiation with 512-bit moduli. OpenSSL notes no impact to EC, while DH512 attacks are only just feasible under certain conditions. Public disclosures and advisories confirm the issue an...

CVE-2002-2209

CVE-2002-2209 concerns an unspecified security vulnerability in Baby FTP Server versions before November 7, 2002 . The description provides no details on the root cause, exploit vector, or exact impact, only noting an unknown impact and attack vectors. The NVD entry lists a high base score (10.0)...

CVE-2022-22740

CVE-2022-22740 is confirmed in connected documents as a use-after-free caused by freeing network request objects too early, potentially enabling a crash. Affected products: Firefox ESR < 91.5, Firefox < 96, and Thunderbird

CVE-2021-26251

The CVE-2021-26251 issue affects Intel’s Distribution of OpenVINO Toolkit. The vulnerability is due to improper input validation in the toolkit, which could allow an authenticated user to trigger a denial of service via network access. Affected software is Intel Distribution of OpenVINO Toolkit (...

CVE-2018-16931

CVE-2018-16931 is rejected/not used per the Initial Description.

CVE-2020-10704

CVE-2020-10704 affects Samba acting as an Active Directory Domain Controller. The vulnerability is a stack overflow in the AD DC LDAP server triggered by certain requests, enabling an unauthorized user to cause a denial of service, impacting availability. Public disclosures in connected Debian Fe...

CVE-2018-3174

CVE-2018-3174 affects Oracle MySQL Server (notably the Client programs) with affected versions 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior, and 8.0.12 and prior. Root cause per the sources is a vulnerability in MySQL Server that can, under certain conditions, lead to a hang or a complete...

CVE-2026-33870

Netty HTTP request smuggling vulnerability (CVE-2026-33870) arises from how Netty versions prior to 4.1.132.Final and 4.2.10.Final parse quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. The IBM and OSS/Ecosystem advisories in the connected...

CVE-2025-21765

CVE-2025-21765 is a Linux kernel IPv6 issue where ip6_default_advmss() reads net structures that could disappear without proper protection. The root cause is missing RCU protection in ip6_default_advmss(), which could enable read-time inconsistency. The vulnerability is documented as a Local, Low...

CVE-2024-38203

Technical details for CVE-2024-38203 are not publicly available in the supplied documents. No specifics on affected products, root cause, or remediation are provided here; monitor the feeds for updates from Microsoft and vulnerability trackers.

CVE-2021-46921

CVE-2021-46921 affects the Linux kernel’s locking/qrwlock code. The vulnerability arises in queued_write_lock_slowpath while the wait_lock is held: a reader can observe values before the writer has truly acquired the lock, due to an ordering gap between atomic_cond_read_acquire() and the subseque...

CVE-2023-51766

Exim before 4.97.1 is vulnerable to SMTP smuggling in specific PIPELINING/CHUNKING configurations, enabling a remote attacker to inject messages with a spoofed MAIL FROM and bypass SPF. The root cause cited across multiple sources is that Exim handles end-of-data sequences using . in ways that so...