35,538 results · Clear filters · Feed
-
Critical 9.8CVE-2022-45460 Public exploit
Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431…
-
Unscored —CVE-2022-47529 Public exploit
Insecure Win32 memory objects in Endpoint Windows Agents in RSA NetWitness Platform before 12.2 allow local and admin W…
-
High 8.1CVE-2023-26493 Public exploit
Command Injection in Cocos Engine workflow
Cocos Engine is an open-source framework for building 2D & 3D real-time rendering and interactive content. In the github repo for Cocos Engine the `web-interface-check.yml` was subject to command injection. The `web-interface-check.yml` was triggered when a p…
-
Medium 4.6CVE-2022-48429 Public exploit
In JetBrains Hub before 2022.3.15573, 2022.2.15572, 2022.1.15583 reflected XSS in dashboards was possible
-
Critical 9.8
CVE-2023-1133
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which the Device-status service listens on port 10100/ UDP by default. The service accepts the unverified UDP packets and deserializes the content, which could allow…
-
Unscored —CVE-2023-0179 Public exploit
A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the le…
-
High 7.8CVE-2023-1665 Public exploit
Improper Restriction of Excessive Authentication Attempts in linagora/twake
Improper Restriction of Excessive Authentication Attempts in GitHub repository linagora/twake prior to 0.0.0.
-
Unscored —CVE-2023-25263 Public exploit
In Stimulsoft Designer (Desktop) 2023.1.5, and 2023.1.4, once an attacker decompiles the Stimulsoft.report.dll the atta…
-
Unscored —CVE-2023-25261 Public exploit
Certain Stimulsoft GmbH products are affected by: Remote Code Execution. This affects Stimulsoft Designer (Desktop) 202…
-
High 7.5CVE-2023-20860 Public exploit
Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch
Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a securit…
-
Medium 6.5CVE-2022-32199 Public exploit
db_convert.php in ScriptCase through 9.9.008 is vulnerable to Arbitrary File Deletion by an admin via a directory trave…
-
Critical 9.3
Path Traversal: '\..\filename' in mlflow/mlflow
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1.
-
Medium 5.5CVE-2023-21036 Public exploit
In BitmapExport.java, there is a possible failure to truncate images due to a logic error in the code.Product: AndroidV…
-
High 7.8CVE-2023-20955 Public exploit
In onPrepareOptionsMenu of AppInfoDashboardFragment.java, there is a possible way to bypass admin restrictions and unin…
-
High 7.8
In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional…
KEV Apr 13, 2023 -
High 7.8CVE-2023-20911 Public exploit
In addPermission of PermissionManagerServiceImpl.java , there is a possible failure to persist permission settings due …
-
Medium 6.7CVE-2023-28772 Public exploit
An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow.
-
High 8.8CVE-2023-24788 Public exploit
NotrinosERP vulnerable to SQL Injection
NotrinosERP v0.7 was discovered to contain a SQL injection vulnerability via the OrderNumber parameter at /NotrinosERP/sales/customer_delivery.php.
-
Unscored —CVE-2023-23192 Public exploit
IS Decisions UserLock MFA 11.01 is vulnerable to authentication bypass using scheduled task.
-
High 8.6
Adobe ColdFusion Improper Access Control Arbitrary code execution
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does n…
KEV Mar 15, 2023 -
High 8.8
MinIO is vulnerable to privilege escalation on Linux/MacOS
Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attac…
KEV Sep 19, 2023 -
High 7.5
Minio Information Disclosure in Cluster Deployment
Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, res…
KEV Apr 21, 2023 -
High 7.5CVE-2023-0464 Public exploit
Excessive Resource Usage Verifying X.509 Policy Constraints
A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate …
-
High 7.8CVE-2023-1281 Public exploit
UAF in Linux kernel's tcindex (traffic control index filter) implementation
Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when 'tcf_exts_exec()' is called with the d…
-
High 7.8
A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities w…
KEV Jun 17, 2025 -
Critical 9.8CVE-2023-27100 Public exploit
Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v2…
-
Medium 6.1CVE-2022-45004 Public exploit
Gophish vulnerable to Cross-site Scripting via crafted landing page
Gophish through 0.12.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted landing page.
-
High 7.5CVE-2022-45003 Public exploit
Gophish vulnerable to Denial of Service via crafted payload involving autofocus
Gophish through 0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted payload involving autofocus.
-
High 7.5
Rockwell Automation ThinManager ThinServer Path Traversal Download
In affected versions, path traversal exists when processing a message of type 8 in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker can exploit this vulnerability to download arbitrary files on the disk drive where ThinServer.e…
-
Critical 9.8
Rockwell Automation ThinManager ThinServer Path Traversal Upload
In affected versions, a path traversal exists when processing a message in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker could potentially exploit this vulnerability to upload arbitrary files to any directory on the disk dri…
-
High 7.5CVE-2023-1545 Public exploit
SQL Injection in nilsteampassnet/teampass
SQL Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23.
-
High 7.5
An issue found in Paradox Security Systems IPR512 allows attackers to cause a denial of service via the login.html and …
-
High 8.8CVE-2023-27842 Public exploit
Insecure Permissions vulnerability found in Extplorer File manager eXtplorer v.2.1.15 allows a remote attacker to execu…
-
Unscored —
Slimstat Analytics < 4.9.3.3 - Subscriber+ SQL Injection
The Slimstat Analytics WordPress plugin before 4.9.3.3 does not prevent subscribers from rendering shortcodes that concatenates attributes directly into an SQL query.
-
Medium 6.3CVE-2023-1498 Public exploit
code-projects Responsive Hotel Site Newsletter Log messages.php sql injection
A vulnerability classified as critical has been found in code-projects Responsive Hotel Site 1.0. Affected is an unknown function of the file messages.php of the component Newsletter Log Handler. The manipulation of the argument title leads to sql injection. …
-
Medium 6.1
Squidex before 7.4.0 was discovered to contain a squid.svg cross-site scripting (XSS) vulnerability.
-
Medium 6.3
jeecg-boot qurestSql sql injection
A vulnerability classified as critical has been found in jeecg-boot 3.5.0. This affects an unknown part of the file jmreport/qurestSql. The manipulation of the argument apiSelectId leads to sql injection. It is possible to initiate the attack remotely. The ex…
-
Unscored —
A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated atta…
-
High 8.8
TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability …
KEV May 1, 2023 -
High 8.2CVE-2023-24892 Public exploit
Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability
Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability