Tue, May 23 · 04:29 AM CDTCVE-2016-9841
9.8/10 · Must read/watchNVDvuln
Summary
inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
CVECVE-2016-9841
SeverityCRITICAL
TypeUPDATED
PublishedTue, May 23 · 04:29 AM CDT
ModifiedTue, Jul 14 · 12:16 PM CDT
CVE-2022-23303
9.8/10 · Must read/watchNVDvuln
Summary
The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9494.
CVECVE-2022-23303
SeverityCRITICAL
TypeUPDATED
PublishedMon, Jan 17 · 02:15 AM CST
ModifiedTue, Jul 14 · 12:16 PM CDT
CVE-2022-23304
9.8/10 · Must read/watchNVDvuln
Summary
The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9495.
CVECVE-2022-23304
SeverityCRITICAL
TypeUPDATED
PublishedMon, Jan 17 · 02:15 AM CST
ModifiedTue, Jul 14 · 12:16 PM CDT
CVE-2022-37434
9.8/10 · Must read/watchNVDvuln
Summary
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the n
CVECVE-2022-37434
SeverityCRITICAL
TypeUPDATED
PublishedFri, Aug 05 · 07:15 AM CDT
ModifiedTue, Jul 14 · 12:16 PM CDT
CVE-2022-48174
9.8/10 · Must read/watchNVDvuln
Summary
There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.
CVECVE-2022-48174
SeverityCRITICAL
TypeUPDATED
PublishedTue, Aug 22 · 07:16 PM CDT
ModifiedTue, Jul 14 · 12:16 PM CDT
CVE-2023-28531
9.8/10 · Must read/watchNVDvuln
Summary
ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.
CVECVE-2023-28531
SeverityCRITICAL
TypeUPDATED
PublishedFri, Mar 17 · 04:15 AM CDT
ModifiedTue, Jul 14 · 12:16 PM CDT
CVE-2023-45853
9.8/10 · Must read/watchNVDvuln
Summary
MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, a
CVECVE-2023-45853
SeverityCRITICAL
TypeUPDATED
PublishedSat, Oct 14 · 02:15 AM CDT
ModifiedTue, Jul 14 · 01:17 PM CDT
CVE-2024-11680
9.8/10 · Must read/watchNVDvuln
Summary
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create
CVECVE-2024-11680
SeverityCRITICAL
TypeUPDATED
PublishedTue, Nov 26 · 10:15 AM CST
ModifiedTue, Jul 14 · 11:17 PM CDT
CVE-2024-22051
9.8/10 · Must read/watchNVDvuln
Summary
CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. This vulnerability can result in possibly unauthenticated remote attackers to cause heap memory corruption, potentially leading to an information leak or remote code execution, via parsing tables with marker rows that contain more t
CVECVE-2024-22051
SeverityCRITICAL
TypeUPDATED
PublishedThu, Jan 04 · 09:15 PM CST
ModifiedTue, Jul 14 · 11:17 PM CDT
CVE-2024-23052
9.8/10 · Must read/watchNVDvuln
Summary
An issue in WuKongOpenSource WukongCRM v.72crm_9.0.1_20191202 allows a remote attacker to execute arbitrary code via the parseObject() function in the fastjson component.
CVECVE-2024-23052
SeverityCRITICAL
TypeUPDATED
PublishedThu, Feb 29 · 01:44 AM CST
ModifiedTue, Jul 14 · 03:06 PM CDT
CVE-2024-23679
9.8/10 · Must read/watchNVDvuln
Summary
Enonic XP versions less than 7.7.4 are vulnerable to a session fixation issue. An remote and unauthenticated attacker can use prior sessions due to the lack of invalidating session attributes.
CVECVE-2024-23679
SeverityCRITICAL
TypeUPDATED
PublishedFri, Jan 19 · 09:15 PM CST
ModifiedTue, Jul 14 · 11:17 PM CDT
CVE-2024-36265
9.8/10 · Must read/watchNVDvuln
Summary
** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Submarine Server Core. This issue affects Apache Submarine Server Core: from 0.8.0. An attacker can bypass authentication by sending specially crafted REST requests. As this project is retired, we do not plan to release a version that fixes
CVECVE-2024-36265
SeverityCRITICAL
TypeUPDATED
PublishedWed, Jun 12 · 03:15 PM CDT
ModifiedTue, Jul 14 · 11:16 AM CDT
CVE-2024-6127
9.8/10 · Must read/watchNVDvuln
Summary
BC Security Empire before 5.9.3 is vulnerable to a path traversal issue that can lead to remote code execution. A remote, unauthenticated attacker can exploit this vulnerability over HTTP by acting as a normal agent, completing all cryptographic handshakes, and then triggering an upload of payload data containing a mal
CVECVE-2024-6127
SeverityCRITICAL
TypeUPDATED
PublishedThu, Jun 27 · 08:15 PM CDT
ModifiedTue, Jul 14 · 11:17 PM CDT
CVE-2024-23687
9.1/10 · Must read/watchNVDvuln
Summary
Hard-coded credentials in FOLIO mod-data-export-spring versions before 1.5.4 and from 2.0.0 to 2.0.2 allows unauthenticated users to access critical APIs, modify user data, modify configurations including single-sign-on, and manipulate fees/fines.
CVECVE-2024-23687
SeverityCRITICAL
TypeUPDATED
PublishedFri, Jan 19 · 10:15 PM CST
ModifiedTue, Jul 14 · 11:17 PM CDT
CVE-2016-9840
8.8/10 · Worth your timeNVDvuln
Summary
inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
CVECVE-2016-9840
SeverityHIGH
TypeUPDATED
PublishedTue, May 23 · 04:29 AM CDT
ModifiedTue, Jul 14 · 12:16 PM CDT
CVE-2016-9842
8.8/10 · Worth your timeNVDvuln
Summary
The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.
CVECVE-2016-9842
SeverityHIGH
TypeUPDATED
PublishedTue, May 23 · 04:29 AM CDT
ModifiedTue, Jul 14 · 12:16 PM CDT
CVE-2024-23689
8.8/10 · Worth your timeNVDvuln
Summary
Exposure of sensitive information in exceptions in ClichHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-client versions less than 0.4.6 allows unauthorized users to gain access to client certificate passwords via client exception logs. This occurs when 'sslkey' is specified and a
CVECVE-2024-23689
SeverityHIGH
TypeUPDATED
PublishedFri, Jan 19 · 09:15 PM CST
ModifiedTue, Jul 14 · 11:17 PM CDT
CVE-2024-21626
8.6/10 · Worth your timeNVDvuln
Summary
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a
CVECVE-2024-21626
SeverityHIGH
TypeUPDATED
PublishedWed, Jan 31 · 10:15 PM CST
ModifiedWed, Jul 15 · 02:17 AM CDT
CVE-2024-21529
8.2/10 · Worth your timeNVDvuln
Summary
Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. This vulnerability allows the attacker to inject malicious object property using the built-in Object property __proto__, which is recursively assigned to all the objects in the pro
CVECVE-2024-21529
SeverityHIGH
TypeUPDATED
PublishedWed, Sep 11 · 05:15 AM CDT
ModifiedTue, Jul 14 · 04:16 PM CDT
CVE-2024-23681
8.2/10 · Worth your timeNVDvuln
Summary
Artemis Java Test Sandbox versions before 1.11.2 are vulnerable to a sandbox escape when an attacker loads untrusted libraries using System.load or System.loadLibrary. An attacker can abuse this issue to execute arbitrary Java when a victim executes the supposedly sandboxed code.
CVECVE-2024-23681
SeverityHIGH
TypeUPDATED
PublishedFri, Jan 19 · 09:15 PM CST
ModifiedTue, Jul 14 · 11:17 PM CDT
CVE-2024-23682
8.2/10 · Worth your timeNVDvuln
Summary
Artemis Java Test Sandbox versions before 1.8.0 are vulnerable to a sandbox escape when an attacker includes class files in a package that Ares trusts. An attacker can abuse this issue to execute arbitrary Java when a victim executes the supposedly sandboxed code.
CVECVE-2024-23682
SeverityHIGH
TypeUPDATED
PublishedFri, Jan 19 · 09:15 PM CST
ModifiedTue, Jul 14 · 11:17 PM CDT
CVE-2024-23683
8.2/10 · Worth your timeNVDvuln
Summary
Artemis Java Test Sandbox versions less than 1.7.6 are vulnerable to a sandbox escape when an attacker crafts a special subclass of InvocationTargetException. An attacker can abuse this issue to execute arbitrary Java when a victim executes the supposedly sandboxed code.
CVECVE-2024-23683
SeverityHIGH
TypeUPDATED
PublishedFri, Jan 19 · 09:15 PM CST
ModifiedTue, Jul 14 · 11:17 PM CDT
CVE-2025-2609
8.2/10 · Worth your timeNVDvuln
Summary
Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling login logging allows unauthenticated users to store HTML content in the viewable log component accessible at /mbilling/index.php/logUsers/read" cross-site scripting This vulnerability is associated with program fil
CVECVE-2025-2609
SeverityHIGH
TypeUPDATED
PublishedFri, Mar 21 · 11:15 PM CDT
ModifiedTue, Jul 14 · 11:17 PM CDT
CVE-2023-52927
7.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: allow exp not to be removed in nf_ct_find_expectation Currently nf_conntrack_in() calling nf_ct_find_expectation() will remove the exp from the hash table. However, in some scenario, we expect the exp not to be removed when the created ct wi
CVECVE-2023-52927
SeverityHIGH
TypeUPDATED
PublishedFri, Mar 14 · 03:15 PM CDT
ModifiedTue, Jul 14 · 01:17 PM CDT
CVE-2024-46786
7.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: fscache: delete fscache_cookie_lru_timer when fscache exits to avoid UAF The fscache_cookie_lru_timer is initialized when the fscache module is inserted, but is not deleted when the fscache module is removed. If timer_reduce() is called before removing
CVECVE-2024-46786
SeverityHIGH
TypeUPDATED
PublishedWed, Sep 18 · 08:15 AM CDT
ModifiedTue, Jul 14 · 01:17 PM CDT
