35,538 results · Clear filters · Feed
-
Unscored —CVE-2023-40930 Public exploit
An issue in the directory /system/bin/blkid of Skyworth v3.0 allows attackers to perform a directory traversal via moun…
-
Critical 9.8
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible
KEV Oct 4, 2023 -
Unscored —CVE-2020-24089 Public exploit
An issue was discovered in ImfHpRegFilter.sys in IOBit Malware Fighter version 8.0.2, allows local attackers to cause a…
-
Unscored —CVE-2023-36319 Public exploit
File Upload vulnerability in Openupload Stable v.0.4.3 allows a remote attacker to execute arbitrary code via the actio…
-
Unscored —CVE-2023-40933 Public exploit
A SQL injection vulnerability in Nagios XI v5.11.1 and below allows authenticated attackers with announcement banner co…
-
Unscored —
A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attacker…
-
Critical 9.8
A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA
A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request.
-
Unscored —CVE-2023-43115 Public exploit
In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript …
-
Unscored —CVE-2021-26837 Public exploit
SQL Injection vulnerability in SearchTextBox parameter in Fortra (Formerly HelpSystems) DeliverNow before version 1.2.1…
-
Low 3.5CVE-2023-5024 Public exploit
Planno Comment cross site scripting
A vulnerability was found in Planno 23.04.04. It has been classified as problematic. This affects an unknown part of the component Comment Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has…
-
High 8.2
JumpServer session replays download without authentication
JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, O…
-
Medium 5.3CVE-2023-40167 Public exploit
Jetty accepts "+" prefixed value in Content-Length
Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and othe…
-
High 7.5
When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl…
-
Unscored —CVE-2023-41436 Public exploit
Cross Site Scripting vulnerability in CSZCMS v.1.3.0 allows a local attacker to execute arbitrary code via a crafted sc…
-
Unscored —CVE-2023-38891 Public exploit
SQL injection vulnerability in Vtiger CRM v.7.5.0 allows a remote authenticated attacker to escalate privileges via the…
-
High 7.8CVE-2023-36250 Public exploit
CSV Injection vulnerability in GNOME time tracker version 3.0.2, allows local attackers to execute arbitrary code via c…
-
Unscored —CVE-2023-40869 Public exploit
Cross Site Scripting vulnerability in mooSocial mooSocial Software 3.1.6 and 3.1.7 allows a remote attacker to execute …
-
Unscored —CVE-2023-40868 Public exploit
Cross Site Request Forgery vulnerability in mooSocial MooSocial Software v.Demo allows a remote attacker to execute arb…
-
Unscored —CVE-2023-41011 Public exploit
Command Execution vulnerability in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows …
-
Unscored —CVE-2023-42362 Public exploit
An arbitrary file upload vulnerability in Teller Web App v.4.4.0 allows a remote attacker to execute arbitrary commands…
-
Unscored —CVE-2023-37739 Public exploit
i-doit Pro v25 and below was discovered to be vulnerable to path traversal.
-
Unscored —CVE-2023-37756 Public exploit
I-doit pro 25 and below and I-doit open 25 and below employ weak password requirements for Administrator account creati…
-
Unscored —CVE-2023-37755 Public exploit
i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator credentials, an…
-
Medium 6.5
PaperCut NG Unauthenticated XMLRPC
PaperCut NG allows for unauthenticated XMLRPC commands to be run by default. Versions 22.0.12 and below are confirmed to be affected, but later versions may also be affected due to lack of a vendor supplied patch.
-
Critical 10.0
Craft CMS Remote Code Execution vulnerability
Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector. Users running Craft installations before 4.4.15 are encouraged to update to at least that version to mitigate the issue. This issue has been fixed i…
-
Medium 5.5CVE-2023-3280 Public exploit
Cortex XDR Agent: Local Windows User Can Disable the Agent
A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to disable the agent.
-
High 7.8
[Google Project Zero] Adobe Acrobat DC OOBW 0-day actively exploited in the wild
Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation o…
KEV Sep 14, 2023 -
Unscored —CVE-2023-42469 Public exploit
The com.full.dialer.top.secure.encrypted application through 1.0.1 for Android enables any installed application (with …
-
Unscored —CVE-2023-42468 Public exploit
The com.cutestudio.colordialer application through 2.1.8-2 for Android allows a remote attacker to initiate phone calls…
-
Medium 5.9CVE-2023-4813 Public exploit
Glibc: potential use-after-free in gaih_inet()
A flaw has been identified in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/…
-
Critical 9.9
Printer web page invalid command execution
Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injection.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to…
-
High 8.0
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
-
High 7.8
Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability
Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability
KEV Sep 12, 2023 -
High 8.8
Windows Themes Remote Code Execution Vulnerability
Windows Themes Remote Code Execution Vulnerability
-
High 8.8
libwebp: OOB write in BuildHuffmanTable
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
KEV Sep 13, 2023 -
High 8.2CVE-2022-48474 Public exploit
Control de Ciber, in its 1.650 version, is affected by a Denial of Service condition through the version function. Send…
-
High 8.2CVE-2022-4896 Public exploit
Cyber Control, in its 1.650 version, is affected by a vulnerability in the generation on the server of pop-up windows w…
-
Unscored —CVE-2023-35687 Public exploit
In MtpPropertyValue of MtpProperty.h, there is a possible memory corruption due to a use after free. This could lead to…
-
High 8.8
In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the co…
KEV Sep 13, 2023 -
Unscored —CVE-2023-35671 Public exploit
In onHostEmulationData of HostEmulationManager.java, there is a possible way for a general purpose NFC reader to read t…