Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.
Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. This is an announcement of the upcoming removal of ltmdm64.sys driver. The driver has been removed in the October cumulative update.
Fax modem hardware dependent on this specific driver will no longer work on Windows.
Microsoft recommends removing any existing dependencies on this hardware.
SKYSEA Client View suffers from an improper authentication vulnerability that enables remote code execution through a flaw in how authentication is processed on the TCP connection with the management console. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information are provided.
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.
CVE-2021-43798 is a path traversal vulnerability in Grafana that allows unauthorized access to local files. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a <details> tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.
Microsoft Internet Explorer contains an uninitialized memory corruption vulnerability that could allow remote code execution. The affected product may be end-of-life or end-of-service, and users are advised to discontinue its use. Exploits for this vulnerability have been observed in the wild.
CVE-2021-22555 is a heap out-of-bounds write vulnerability in the Linux Kernel that can be exploited by an attacker to gain elevated privileges or cause a denial of service through heap memory corruption. The vulnerability arises from improper handling of user namespace operations. It has been observed to be exploited in the wild, indicating active threat usage. No specific affected versions or patch information is provided in the available data.
CVE-2021-43226 is a privilege escalation vulnerability in the Microsoft Windows Common Log File System Driver. It allows a local attacker with some privileges to bypass certain security mechanisms, potentially leading to elevated privileges. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. No specific affected versions or patch information is provided in the available data.
CVE-2010-3765 is a critical heap buffer overflow vulnerability affecting multiple Mozilla products including Firefox, SeaMonkey, and Thunderbird. The flaw involves memory corruption triggered by JavaScript operations related to nsCSSFrameConstructor::ContentAppended, appendChild method, and frame creation. It allows remote attackers to execute arbitrary code when JavaScript is enabled. The vulnerability was actively exploited in the wild and was fixed in Firefox 3.5.15, 3.6.12, SeaMonkey 2.0.10, and Thunderbird 3.0.10 and 3.1.6.
CVE-2013-3918 is an out-of-bounds write vulnerability in the Microsoft Windows InformationCardSigninHelper Class ActiveX control (icardie.dll). An attacker can exploit this by crafting a malicious webpage that, when viewed by a user, may allow remote code execution with the same privileges as the current user. The affected Windows product may be end-of-life or end-of-service, and users are advised to discontinue its use.
CVE-2011-3402 is a high-severity remote code execution vulnerability in the Microsoft Windows kernel, specifically in the TrueType font parsing engine within win32k.sys. This flaw allows remote attackers to execute arbitrary code by delivering crafted font data embedded in Word documents or web pages. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Juniper ScreenOS has an improper authentication vulnerability (CVE-2015-7755) that allows unauthorized remote administrative access to affected devices. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.
Jenkins contains a remote code execution vulnerability identified as CVE-2017-1000353. The flaw allows attackers to send a serialized Java SignedObject to the Jenkins CLI remoting interface, which is then deserialized using a new ObjectInputStream. This process bypasses the existing blocklist-based protection, enabling remote code execution. The vulnerability has been exploited in the wild.
GNU Bash contains an OS command injection vulnerability (CVE-2014-6278) that allows remote attackers to execute arbitrary commands via a crafted environment. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the input data.
Smartbedded Meteobridge contains a command injection vulnerability (CVE-2025-4008) that allows remote unauthenticated attackers to execute arbitrary commands with root privileges. The vulnerability has a high severity score of 8.7 and is known to be exploited in the wild. No affected versions or patch information are currently provided.
Adminer contains a server-side request forgery (SSRF) vulnerability that allows a remote attacker to obtain potentially sensitive information. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.