Adobe Commerce versions up to 2.4.4-p15 are affected by an improper input validation vulnerability (CWE-20) that allows an attacker to perform session takeover without user interaction. This vulnerability has a critical severity with a CVSS score of 9.1, impacting confidentiality and integrity. Exploitation is known in the wild. No patch or remediation details are provided in the available data.
Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an attacker to execute arbitrary code by sending specially crafted packets.
An unspecified vulnerability in the JavaScriptCore component affects multiple Apple products including macOS, iOS, tvOS, Safari, and watchOS. This flaw may allow arbitrary code execution when processing web content. The affected products could include versions that are end-of-life or end-of-service, and users are advised to discontinue use of impacted products. Exploitation of this vulnerability has been observed in the wild.
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVE-2025-33073 is a high-severity vulnerability in Microsoft Windows 10 Version 1507 involving improper access control in the SMB protocol. It allows an authorized attacker to elevate privileges over a network without requiring user interaction. The vulnerability has a CVSS score of 8.8, indicating a significant impact on confidentiality, integrity, and availability. No patch or remediation information is currently provided by the vendor. There are no known exploits in the wild at this time.
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.178.
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.172.
Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.
Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. This is an announcement of the upcoming removal of ltmdm64.sys driver. The driver has been removed in the October cumulative update.
Fax modem hardware dependent on this specific driver will no longer work on Windows.
Microsoft recommends removing any existing dependencies on this hardware.
SKYSEA Client View suffers from an improper authentication vulnerability that enables remote code execution through a flaw in how authentication is processed on the TCP connection with the management console. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information are provided.
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.
CVE-2021-43798 is a path traversal vulnerability in Grafana that allows unauthorized access to local files. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a <details> tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.
Microsoft Internet Explorer contains an uninitialized memory corruption vulnerability that could allow remote code execution. The affected product may be end-of-life or end-of-service, and users are advised to discontinue its use. Exploits for this vulnerability have been observed in the wild.
CVE-2021-22555 is a heap out-of-bounds write vulnerability in the Linux Kernel that can be exploited by an attacker to gain elevated privileges or cause a denial of service through heap memory corruption. The vulnerability arises from improper handling of user namespace operations. It has been observed to be exploited in the wild, indicating active threat usage. No specific affected versions or patch information is provided in the available data.
CVE-2021-43226 is a privilege escalation vulnerability in the Microsoft Windows Common Log File System Driver. It allows a local attacker with some privileges to bypass certain security mechanisms, potentially leading to elevated privileges. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. No specific affected versions or patch information is provided in the available data.
CVE-2010-3765 is a critical heap buffer overflow vulnerability affecting multiple Mozilla products including Firefox, SeaMonkey, and Thunderbird. The flaw involves memory corruption triggered by JavaScript operations related to nsCSSFrameConstructor::ContentAppended, appendChild method, and frame creation. It allows remote attackers to execute arbitrary code when JavaScript is enabled. The vulnerability was actively exploited in the wild and was fixed in Firefox 3.5.15, 3.6.12, SeaMonkey 2.0.10, and Thunderbird 3.0.10 and 3.1.6.
CVE-2013-3918 is an out-of-bounds write vulnerability in the Microsoft Windows InformationCardSigninHelper Class ActiveX control (icardie.dll). An attacker can exploit this by crafting a malicious webpage that, when viewed by a user, may allow remote code execution with the same privileges as the current user. The affected Windows product may be end-of-life or end-of-service, and users are advised to discontinue its use.
CVE-2011-3402 is a high-severity remote code execution vulnerability in the Microsoft Windows kernel, specifically in the TrueType font parsing engine within win32k.sys. This flaw allows remote attackers to execute arbitrary code by delivering crafted font data embedded in Word documents or web pages. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.