CVE-2021-25487 is an out-of-bounds read vulnerability in Samsung mobile devices affecting the modem interface driver. It arises from insufficient boundary checking in the set_skb_priv() function, which can lead to remote code execution by dereferencing an invalid function pointer. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided.
Samsung mobile devices have an improper input validation vulnerability in the modem interface driver. This flaw is a format string bug that can cause a kernel panic. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.
Samsung mobile devices have a race condition vulnerability in the MFC charger driver that can lead to a use-after-free condition, enabling a write operation if radio privileges are compromised. This vulnerability has been exploited in the wild.
Samsung mobile devices have a race condition vulnerability in the MFC charger driver that can lead to a use-after-free condition. This vulnerability allows a write operation if the attacker has compromised radio privileges. It has been exploited in the wild and is considered a high severity issue.
Samsung mobile devices have an unspecified vulnerability in the DSP driver that permits attackers to load ELF libraries inside the DSP. This vulnerability is known to be exploited in the wild. No specific affected versions or patch information is provided.
Samsung mobile devices have a vulnerability in the DSP driver due to improper boundary checks, which allows out-of-bounds memory access. This flaw has been exploited in the wild. No specific affected versions or patches are provided in the available data.
In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-251586912
CVE-2023-32439 is a high-severity type confusion vulnerability in Apple iOS, iPadOS, macOS Ventura, and Safari that allows arbitrary code execution when processing maliciously crafted web content. The flaw arises from insufficient type checks, which Apple has addressed in iOS 16.5.1, iPadOS 16.5.1, iOS 15.7.7, iPadOS 15.7.7, macOS Ventura 13.
CVE-2023-32435 is a high-severity memory corruption vulnerability in Apple macOS and iOS that allows arbitrary code execution when processing web content. It affects versions of iOS prior to 15.7 and macOS versions before Ventura 13.3, as well as Safari 16.4 and related OS versions. The flaw arises from improper state management leading to memory corruption (CWE-787). Apple has released patches in macOS Ventura 13.3, iOS 16.4, iPadOS 16.4, and iOS/iPadOS 15.
CVE-2023-32434 is a high-severity vulnerability in Apple operating systems including macOS, iOS, iPadOS, and watchOS, caused by an integer overflow that allows an app to execute arbitrary code with kernel privileges. The flaw affects versions prior to the patched releases such as iOS 15.7.7 and macOS Big Sur 11.7.8. Exploitation requires local access and user interaction but no prior authentication. Apple has addressed the issue through improved input validation in multiple OS updates. Although no confirmed active exploitation is reported, Apple acknowledges potential active exploitation on iOS versions before 15.7.
CVE-2023-32409 is a vulnerability in Apple macOS and related Apple operating systems that allows a remote attacker to potentially break out of the Web Content sandbox. This sandbox is designed to isolate web content processes to prevent malicious code from affecting the broader system. The vulnerability has been addressed by Apple through improved bounds checking and fixed in multiple OS versions including macOS Ventura 13.4, iOS 15.7.8, iPadOS 15.7.8, and Safari 16.5. Although Apple is aware of reports that this vulnerability may have been actively exploited, no confirmed widespread exploitation has been documented.
CVE-2023-32373 is a high-severity use-after-free vulnerability in Apple macOS and related operating systems that can lead to arbitrary code execution when processing maliciously crafted web content. The flaw arises from improper memory management, which Apple has addressed in recent updates including macOS Ventura 13.4, iOS 15.7.6, iPadOS 15.7.6, watchOS 9.5, tvOS 16.5, and Safari 16.5.
An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been actively exploited.
CVE-2020-35730 is a cross-site scripting (XSS) vulnerability in Roundcube Webmail. It allows attackers to send plain text emails containing JavaScript in a link reference element, which is improperly handled by the linkref_addinindex function in rcube_string_replacer.php. This vulnerability has been exploited in the wild and is considered high severity.
CVE-2020-12641 is a remote code execution vulnerability in Roundcube Webmail. It allows attackers to execute arbitrary code by injecting shell metacharacters into configuration settings related to im_convert_path or im_identify_path. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2021-44026 is a high severity SQL injection vulnerability in Roundcube Webmail that affects the search functionality. This vulnerability allows attackers to inject malicious SQL queries via the search or search_params parameters. It has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2016-9079 is a critical use-after-free vulnerability in the SVG Animation component affecting Mozilla Firefox, Firefox ESR, and Thunderbird. It specifically impacts Firefox and Tor Browser users on Windows. The vulnerability was actively exploited in the wild. Mozilla addressed this issue with fixes released in Firefox 50.0.2, Firefox ESR 45.5.1, and Thunderbird 45.5.1.
CVE-2016-0165 is a high-severity privilege escalation vulnerability in Microsoft Win32k. It allows an attacker to gain elevated privileges on affected systems. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2023-2533 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability in PaperCut NG/MF version 22.0.10. It allows an attacker to trick an authenticated administrator into executing unauthorized actions by clicking a malicious link, potentially leading to changes in security settings or arbitrary code execution. Exploitation requires the admin to be logged in and interact with the malicious content. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS score of 8.4. No known exploits are currently in the wild. European organizations using PaperCut NG/MF, especially in sectors with high administrative privileges, should prioritize patching and implement strict access controls to mitigate risk. Countries with significant PaperCut deployments and critical infrastructure are at higher risk.
The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request.