CVE-2019-0676 is an information disclosure vulnerability in Microsoft Internet Explorer where improper handling of objects in memory allows an attacker to test for the presence of files on disk. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2019-5786 is a heap use-after-free vulnerability in Google Chrome's Blink rendering engine. This flaw allows an attacker to potentially perform out-of-bounds memory access by crafting a malicious HTML page. The vulnerability has been exploited in the wild, indicating active attacks leveraging this issue. No specific affected versions or patch information are provided in the available data.
CVE-2019-0703 is an information disclosure vulnerability in the Microsoft Windows SMB Server. It arises from the way the SMB Server handles certain requests, potentially allowing unauthorized disclosure of information from the server. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2019-0880 is a local privilege escalation vulnerability in Microsoft Windows involving the splwow64.exe process. Exploitation allows an attacker to elevate privileges from low-integrity to medium-integrity on an affected system. This vulnerability has been observed exploited in the wild.
CVE-2019-11707 is a type confusion vulnerability in Mozilla Firefox and Thunderbird that arises from issues in the Array.pop JavaScript method. This flaw can lead to an exploitable crash when manipulating JavaScript objects. It has been observed to be exploited in the wild.
CVE-2019-11708 is a sandbox escape vulnerability in Mozilla Firefox and Thunderbird that could allow remote code execution. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2019-8720 is a memory corruption vulnerability in WebKitGTK that can enable remote code execution by an attacker. It has been exploited in the wild, indicating active use by threat actors. The vulnerability is categorized under CWE-119, which relates to improper restriction of operations within the bounds of a memory buffer. No specific affected versions or patch information is provided in the available data.
CVE-2019-18426 is a high-severity cross-site scripting (XSS) vulnerability affecting WhatsApp Desktop when paired with WhatsApp for iPhone. This flaw allows an attacker to execute malicious scripts and read local files under certain conditions. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.
CVE-2019-1385 is a privilege escalation vulnerability in Microsoft Windows involving the AppX Deployment Extensions. The vulnerability arises from improper privilege management, allowing unauthorized access to system files. It has been exploited in the wild and is known to have been used in ransomware campaigns. No specific affected Windows versions are provided in the available data.
CVE-2019-1130 is a privilege escalation vulnerability in Microsoft Windows AppX Deployment Service (AppXSVC) caused by improper handling of hard links. This flaw allows attackers to gain elevated privileges on affected systems. It has been exploited in the wild and is known to have been used in ransomware campaigns.
CVE-2018-5002 is a high-severity stack-based buffer overflow vulnerability in Adobe Flash Player that can lead to remote code execution. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided in the available data.
CVE-2018-8589 is a privilege escalation vulnerability in Microsoft Windows Win32k.sys where improper handling of calls allows an attacker to execute code with local system privileges. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided in the input data.
CVE-2022-30525 is a command injection vulnerability affecting certain Zyxel firewall devices. The flaw exists in a CGI program, allowing attackers to modify files and execute operating system commands on vulnerable devices. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.
Spring Cloud Gateway applications with the Gateway Actuator endpoint enabled, exposed, and unsecured are vulnerable to a code injection attack. This vulnerability allows attackers to execute arbitrary code remotely. It has been exploited in the wild and is considered a high severity threat.
CVE-2022-1388 is a high-severity vulnerability in F5 BIG-IP that involves missing authentication in a critical function. This flaw allows remote attackers to execute arbitrary code, create or delete files, or disable services on affected systems. The vulnerability has been exploited in the wild and is known to be used in ransomware campaigns.
CVE-2021-1789 is a type confusion vulnerability affecting multiple Apple products. It involves processing maliciously crafted web content that can lead to arbitrary code execution. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.
CVE-2019-8506 is a type confusion vulnerability affecting multiple Apple products. It involves processing maliciously crafted web content that can lead to arbitrary code execution. This vulnerability has been exploited in the wild, indicating active use by attackers. No specific affected versions or patch information is provided in the available data.
CVE-2014-4113 is a high-severity privilege escalation vulnerability in Microsoft Win32k. The vulnerability allows an attacker to elevate privileges on an affected system. It has been exploited in the wild. Specific affected versions and technical details are not provided in the available data.
CVE-2014-0322 is a use-after-free vulnerability in Microsoft Internet Explorer that allows remote attackers to execute arbitrary code. This vulnerability has been exploited in the wild. It affects Internet Explorer versions as specified by Microsoft advisories, though no specific affected versions are listed here. The vulnerability is categorized as high severity due to the potential for remote code execution.
CVE-2014-0160, known as the Heartbleed vulnerability, is a high severity flaw in OpenSSL's TLS and DTLS implementations. It arises from improper handling of Heartbeat Extension packets, enabling remote attackers to extract sensitive information from affected systems. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the input data.