35,538 results · Clear filters · Feed
-
High 8.8CVE-2023-24871 Public exploit
Windows Bluetooth Service Remote Code Execution Vulnerability
Windows Bluetooth Service Remote Code Execution Vulnerability
-
Medium 4.5CVE-2023-23408 Public exploit
Azure Apache Ambari Spoofing Vulnerability
Azure Apache Ambari Spoofing Vulnerability
-
High 7.8CVE-2023-23399 Public exploit
Microsoft Excel Remote Code Execution Vulnerability
Microsoft Excel Remote Code Execution Vulnerability
-
Critical 9.8
Microsoft Outlook Elevation of Privilege Vulnerability
Microsoft Outlook Elevation of Privilege Vulnerability
KEV Mar 14, 2023 -
Medium 6.5CVE-2023-23396 Public exploit
Microsoft Excel Denial of Service Vulnerability
Microsoft Excel Denial of Service Vulnerability
-
High 8.8CVE-2023-23388 Public exploit
Windows Bluetooth Driver Elevation of Privilege Vulnerability
Windows Bluetooth Driver Elevation of Privilege Vulnerability
-
Unscored —
OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in the index.php/manageme…
-
High 7.2CVE-2023-26262 Public exploit
An issue was discovered in Sitecore XP/XM 10.3. As an authenticated Sitecore user, a unrestricted language file upload …
-
High 7.8CVE-2023-27010 Public exploit
Wondershare Dr.Fone v12.9.6 was discovered to contain weak permissions for the service WsDrvInst. This vulnerability al…
-
High 7.4
ReadtoMyShoe, a web app that lets users upload articles and listen to them later, generates an error message containing…
-
High 7.5
Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database…
KEV Aug 22, 2023 -
Low 3.5CVE-2023-26209 Public exploit
A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiDeceptor 3.1.x and…
-
Low 3.5CVE-2023-26208 Public exploit
A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiAuthenticator 6.4.…
-
Low 3.5CVE-2022-29056 Public exploit
A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiMail version 6.4.0…
-
Medium 5.0CVE-2023-23638 Public exploit
Apache Dubbo Deserialization Vulnerability Gadgets Bypass
A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x …
-
Critical 9.8CVE-2023-0090 Public exploit
Proofpoint Enterprise Protection webservices unauthenticated RCE
The webservices in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows for an anonymous user to execute remote code through 'eval injection'. Exploitation requires network access to the webservices API, but such access is a non-stan…
-
High 8.8CVE-2023-0089 Public exploit
Proofpoint Enterprise Protection webutils authenticated RCE
The webutils in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows an authenticated user to execute remote code through 'eval injection'. This affects all versions 8.20.0 and below.
-
Medium 6.1
phpipam v1.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the closeClass paramete…
-
Medium 6.8CVE-2022-41333 Public exploit
An uncontrolled resource consumption vulnerability [CWE-400] in FortiRecorder version 6.4.3 and below, 6.0.11 and below…
-
Critical 9.8
Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy
Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific patter…
-
Critical 9.8
SQL Injection in Funadmin
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \member\Member.php.
-
Low 3.3CVE-2023-1189 Public exploit
WiseCleaner Wise Folder Hider IoControlCode WiseFs64.sys 0x222410 denial of service
A vulnerability was found in WiseCleaner Wise Folder Hider 4.4.3.202. It has been declared as problematic. Affected by this vulnerability is the function 0x222400/0x222404/0x222410 in the library WiseFs64.sys of the component IoControlCode Handler. The manipu…
-
High 7.2CVE-2023-1211 Public exploit
SQL Injection in phpipam/phpipam
SQL Injection in GitHub repository phpipam/phpipam prior to v1.5.2.
-
High 8.8CVE-2023-24217 Public exploit
AgileBio Electronic Lab Notebook v4.234 was discovered to contain a local file inclusion vulnerability.
-
Unscored —CVE-2022-46395 Public exploit
An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing opera…
-
Medium 5.4CVE-2022-44875 Public exploit
KioWare through 8.33 on Windows sets KioScriptingUrlACL.AclActions.AllowHigh for the about:blank origin, which allows a…
-
Medium 5.4CVE-2022-42248 Public exploit
QlikView 12.60.2 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the QvsViewClient funct…
-
Critical 9.8CVE-2021-36394 Public exploit
Moodle Session Fixation vulnerability
In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin.
-
Critical 9.8
Moodle SQL Injection vulnerability
In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses.
-
High 7.5CVE-2021-36396 Public exploit
Moodle vulnerable to Server-Side Request Forgery
In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk.
-
Medium 6.1
Open redirect in web2py
Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirected to an arbitrary website by accessing a specially crafted URL. As a result, the user may become a victim of a phishing attack.
-
Critical 9.1CVE-2023-27290 Public exploit
IBM Observability with Instana missing authentication
Docker based datastores for IBM Instana (IBM Observability with Instana 239-0 through 239-2, 241-0 through 241-2, and 243-0) do not currently require authentication. Due to this, an attacker within the network could access the datastores with read/write acces…
-
Unscored —CVE-2023-27566 Public exploit
Cubism Core in Live2D Cubism Editor 4.2.03 allows out-of-bounds write via a crafted Section Offset Table or Count Info …
-
High 7.8CVE-2022-45988 Public exploit
starsoftcomm CooCare 5.304 allows local attackers to escalate privileges and execute arbitrary commands via a crafted f…
-
High 7.2
Metform Elementor Contact Form Builder <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via text areas on forms in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for…
-
Unscored —
A Stack-based buffer overflow vulnerability in the SonicOS allows a remote unauthenticated attacker to cause Denial of …
-
Medium 4.7CVE-2023-1112 Public exploit
Drag and Drop Multiple File Upload Contact Form 7 admin-ajax.php path traversal
A vulnerability was found in Drag and Drop Multiple File Upload Contact Form 7 5.0.6.1 on WordPress. It has been classified as critical. Affected is an unknown function of the file admin-ajax.php. The manipulation of the argument upload_name leads to relative…
-
Medium 6.6CVE-2022-3294 Public exploit
Node address isn't always verified when proxying
Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports node proxying, which allows clients of kube-apiserv…
-
High 7.8CVE-2023-0461 Public exploit
Use-after-free vulnerability in the Linux Kernel
There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not …
-
Critical 9.8
SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. …