CVE Brief Security Intelligence

The Blocksy theme for WordPress is vulnerable to PHP Object Injection, enabling Remote Code Execution via the 'blocksy_meta' REST API field.

A path traversal vulnerability in Microsoft Azure Kubernetes Service allows an authenticated attacker to execute arbitrary code locally.

An out-of-bounds write vulnerability in Fortinet FortiOS 7 could allow for memory corruption and potential code execution.

A use-after-free vulnerability in the Google Chrome Ozone implementation allows an attacker to potentially execute arbitrary code.

A use-after-free vulnerability in Google Chrome's File Input component allows an attacker to potentially execute arbitrary code.

A use-after-free vulnerability exists in the FullScreen component of Google Chrome on Windows, potentially allowing memory corruption or arbitrary code execution.

A use-after-free vulnerability exists within the Payments component of Google Chrome, which could be leveraged to cause memory corruption or arbitrary code execution.

A use-after-free vulnerability exists in the Ozone platform abstraction layer of Google Chrome on Linux, potentially allowing for memory corruption or code execution.

A deserialization vulnerability in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

A privilege escalation vulnerability in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to elevate their permissions over a network.

A Server-Side Request Forgery (SSRF) vulnerability in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over the network.

A SQL injection vulnerability in the Oracle RemoteControl API allows an authenticated attacker to inject malicious queries via the invite_participants and remind_participants methods.

The Events Calendar for GeoDirectory plugin for WordPress is vulnerable to unauthorized privilege escalation.

A heap-based buffer overflow in the Remote Desktop Client allows an unauthorized attacker to execute code over a network.

A heap-based buffer overflow in the Remote Desktop Client allows an unauthorized attacker to execute arbitrary code over a network via a malicious server.

A heap-based buffer overflow in the Remote Desktop Client allows an unauthorized attacker to execute code over a network by enticing a user to connect to a malicious server.

A flaw in the Linux kernel SMB client allows for improper validation of DACL pointers, potentially leading to security descriptor corruption.

A race condition in the Linux kernel's mac80211 fast-RX handling can lead to packet processing errors.

A stack-based buffer overflow in Active Directory Domain Services allows an authenticated attacker to execute arbitrary code over a network.

A stack buffer overflow in OpenSSL occurs when parsing CMS AuthEnvelopedData or EnvelopedData messages with maliciously crafted AEAD parameters.

A vulnerability exists in the Flowise drag-and-drop user interface used for building Large Language Model (LLM) flows.

A high-severity vulnerability has been identified in the Samlify Node.js library, which is commonly used for SAML authentication.

A vulnerability has been identified in Siemens SINEC INS, affecting all versions prior to V1.

A vulnerability in Siemens SINEC INS allows for potential security compromise in versions prior to V1.

Hermes WebUI contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands via malicious Git configuration files.

LimeSurvey fails to validate the HTTP Host header when constructing password-reset links, allowing for Host header injection and account takeover.

Adobe ColdFusion contains an unspecified vulnerability that may pose a significant security risk to affected installations.