2,899 results · Clear filters · Feed
-
Critical 10.0
IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated us…
KEV Nov 3, 2021 -
Critical 9.8CVE-2019-19634 Public exploit
class.upload.php in verot.net omits .pht from the set of dangerous file extensions
class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576.
-
Critical 9.8
Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncU…
KEV Nov 3, 2021 -
Critical 9.8
OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity o…
KEV Nov 3, 2021 -
Critical 9.8
This external control of file name or path vulnerability allows remote attackers to access or modify system files. To f…
KEV Jun 8, 2022 -
Critical 9.8
This external control of file name or path vulnerability allows remote attackers to access or modify system files. To f…
KEV Jun 8, 2022 -
Critical 9.8
This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix th…
KEV Jun 8, 2022 -
Critical 9.8
Remote code execution in verot/class.upload.php
class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions.
-
Critical 9.8
An exploitable code execution vulnerability exists in the processing of multi-part/form-data requests within the base G…
-
Critical 9.8
Unrestricted upload of file with dangerous type in Apache Solr
The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default solr.in.sh configuration file shipping with Solr. If you use the default solr.in.sh file from the affected releases, the…
-
Critical 9.8CVE-2019-3663 Public exploit
Advanced Threat Defense (ATD) - Unprotected storage of shared credentials vulnerability
Unprotected Storage of Credentials vulnerability in McAfee Advanced Threat Defense (ATD) prior to 4.8 allows local attacker to gain access to the root password via accessing sensitive files on the system. This was originally published with a CVSS rating of Hi…
-
Critical 9.8
An exploitable command injection vulnerability exists in the Config editor of the Exhibitor Web UI versions 1.0.9 to 1.…
-
Critical 9.8
Strapi allows unauthenticated attacker to reset admin password without valid reset token
strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.
-
Critical 9.8
Struts ParameterInterceptor vulnerability allows remote command execution
Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.
-
Critical 9.8
Ignite Realtime Openfire vulnerable to Server Side Request Forgery
A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests.
-
Critical 9.0CVE-2019-17625 Public exploit
Rambox RCE Vulnerability
There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The problem occurs due to incorrect sanitization of the name field when being processed and stored. This allows a user to craft…
-
Critical 9.9CVE-2019-10760 Public exploit
Sandbox Breakout / Arbitrary Code Execution in safer-eval
safer-eval before 1.3.2 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code.
-
Critical 9.8
Improper Check for Unusual or Exceptional Conditions in Connect2id Nimbus JOSE+JWT
Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.
-
Critical 9.8
Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote c…
KEV Nov 7, 2024 -
Critical 9.8CVE-2019-17495 Public exploit
Cross-site scripting in Swagger-UI
A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other w…
-
Critical 9.8
Liferay Portal Allows RCE via Deserialization of a JSON Payload
Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload.
-
Critical 9.8CVE-2018-14881 Public exploit
The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_REST…
-
Critical 9.8
Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The …
KEV Mar 25, 2022 -
Critical 9.8
vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widg…
KEV Nov 3, 2021 -
Critical 9.8
Polymorphic Typing issue in FasterXML jackson-databind
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
-
Critical 10.0
Command Injection in gitlabhook
NPM package gitlabhook version 0.0.17 is vulnerable to a Command Injection vulnerability. Arbitrary commands can be injected through the repository name.
-
Critical 9.9
Total.js CMS RCE Vulnerability
An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote Command Execution (RCE) on the remote server by creating a malicious widget with a special tag containing JavaScript code that will be eva…
-
Critical 10.0CVE-2019-11061 Public exploit
HG100 has a broken access control vulnerability in its Web API Server
A broken access control vulnerability in HG100 firmware versions up to 4.00.06 allows an attacker in the same local area network to control IoT devices that connect with itself via http://[target]/smarthome/devicecontrol without any authentication. CVSS 3.0 b…
-
Critical 9.8
Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data SCP User Default Credentials Vulnerability
A vulnerability in Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to log in to the CLI of an affected system by using the SCP User accoun…
-
Critical 9.8
Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Authentication Bypass Vulnerability
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to acquire a valid session token …
-
Critical 9.8CVE-2019-15224 Public exploit
rest-client Gem Contains Malicious Code
The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions <=1.6.9 and >=1.6.14 are unaffected.
-
Critical 9.8
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulner…
KEV Mar 25, 2022 -
Critical 9.8
There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators a…
KEV Mar 7, 2022 -
Critical 9.8
SQL Injection in Django
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgre…
-
Critical 9.8CVE-2019-14537 Public exploit
Access of Resource Using Incompatible Type ('Type Confusion') in yourls/yourls
YOURLS through 1.7.3 is affected by a type juggling vulnerability in the api component that can result in login bypass.
-
Critical 9.8
Cisco Small Business 220 Series Smart Switches Remote Code Execution Vulnerabilities
Multiple vulnerabilities in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an unauthenticated, remote attacker to overflow a buffer, which then allows the execution of arbitrary code with root privileges on the unde…
-
Critical 9.1
Cisco Small Business 220 Series Smart Switches Authentication Bypass Vulnerability
A vulnerability in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an unauthenticated, remote attacker to upload arbitrary files. The vulnerability is due to incomplete authorization checks in the web management inte…
-
Critical 9.8
Moby Docker cp broken with debian containers
In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the container.
-
Critical 9.8
XML external entity injection in Terracotta Quartz Scheduler
initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.
-
Critical 9.1CVE-2019-10744 Public exploit
Prototype Pollution in lodash
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.