CVE-2021-0920 is a race condition vulnerability in the Android kernel that results in a use-after-free condition. This flaw can be exploited to escalate privileges on affected devices. The vulnerability has been observed in the wild, indicating active exploitation. No specific affected versions or patch information is provided in the available data.
CVE-2019-1130 is a privilege escalation vulnerability in Microsoft Windows AppX Deployment Service (AppXSVC) caused by improper handling of hard links. This flaw allows attackers to gain elevated privileges on affected systems. It has been exploited in the wild and is known to have been used in ransomware campaigns.
CVE-2020-1027 is a Windows Kernel elevation of privilege vulnerability that allows attackers to execute code with elevated permissions by exploiting how the kernel handles objects in memory. It has been exploited in the wild. No specific affected Windows versions are stated in the provided data.
CVE-2019-8720 is a memory corruption vulnerability in WebKitGTK that can enable remote code execution by an attacker. It has been exploited in the wild, indicating active use by threat actors. The vulnerability is categorized under CWE-119, which relates to improper restriction of operations within the bounds of a memory buffer. No specific affected versions or patch information is provided in the available data.
CVE-2019-11707 is a type confusion vulnerability in Mozilla Firefox and Thunderbird that arises from issues in the Array.pop JavaScript method. This flaw can lead to an exploitable crash when manipulating JavaScript objects. It has been observed to be exploited in the wild.
CVE-2019-11708 is a sandbox escape vulnerability in Mozilla Firefox and Thunderbird that could allow remote code execution. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2020-0638 is a privilege escalation vulnerability in Microsoft Update Notification Manager. It allows attackers to gain elevated privileges on affected systems. The vulnerability has been exploited in the wild and is associated with known ransomware campaigns. No specific affected versions or patch information is provided in the available data.
CVE-2019-13720 is a high-severity use-after-free vulnerability in Google Chrome's WebAudio component. It allows remote attackers to exploit heap corruption by crafting malicious HTML pages. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the input data.
CVE-2019-1385 is a privilege escalation vulnerability in Microsoft Windows involving the AppX Deployment Extensions. The vulnerability arises from improper privilege management, allowing unauthorized access to system files. It has been exploited in the wild and is known to have been used in ransomware campaigns. No specific affected Windows versions are provided in the available data.
CVE-2019-7287 is a memory corruption vulnerability in Apple iOS that could allow remote code execution by an attacker. It has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2019-5786 is a heap use-after-free vulnerability in Google Chrome's Blink rendering engine. This flaw allows an attacker to potentially perform out-of-bounds memory access by crafting a malicious HTML page. The vulnerability has been exploited in the wild, indicating active attacks leveraging this issue. No specific affected versions or patch information are provided in the available data.
CVE-2019-18426 is a high-severity cross-site scripting (XSS) vulnerability affecting WhatsApp Desktop when paired with WhatsApp for iPhone. This flaw allows an attacker to execute malicious scripts and read local files under certain conditions. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.
CVE-2022-30525 is a command injection vulnerability affecting certain Zyxel firewall devices. The flaw exists in a CGI program, allowing attackers to modify files and execute operating system commands on vulnerable devices. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.
Spring Cloud Gateway applications with the Gateway Actuator endpoint enabled, exposed, and unsecured are vulnerable to a code injection attack. This vulnerability allows attackers to execute arbitrary code remotely. It has been exploited in the wild and is considered a high severity threat.
CVE-2022-1388 is a high-severity vulnerability in F5 BIG-IP that involves missing authentication in a critical function. This flaw allows remote attackers to execute arbitrary code, create or delete files, or disable services on affected systems. The vulnerability has been exploited in the wild and is known to be used in ransomware campaigns.
CVE-2014-4113 is a high-severity privilege escalation vulnerability in Microsoft Win32k. The vulnerability allows an attacker to elevate privileges on an affected system. It has been exploited in the wild. Specific affected versions and technical details are not provided in the available data.
CVE-2021-1789 is a type confusion vulnerability affecting multiple Apple products. It involves processing maliciously crafted web content that can lead to arbitrary code execution. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.
CVE-2019-8506 is a type confusion vulnerability affecting multiple Apple products. It involves processing maliciously crafted web content that can lead to arbitrary code execution. This vulnerability has been exploited in the wild, indicating active use by attackers. No specific affected versions or patch information is provided in the available data.
CVE-2014-0160, known as the Heartbleed vulnerability, is a high severity flaw in OpenSSL's TLS and DTLS implementations. It arises from improper handling of Heartbeat Extension packets, enabling remote attackers to extract sensitive information from affected systems. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the input data.
CVE-2014-0322 is a use-after-free vulnerability in Microsoft Internet Explorer that allows remote attackers to execute arbitrary code. This vulnerability has been exploited in the wild. It affects Internet Explorer versions as specified by Microsoft advisories, though no specific affected versions are listed here. The vulnerability is categorized as high severity due to the potential for remote code execution.