35,538 results · Clear filters · Feed
-
Unscored —CVE-2021-32159 Public exploit
A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Upload and Download feature.
-
Unscored —CVE-2021-32158 Public exploit
A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Upload and Download feature.
-
Unscored —CVE-2021-32157 Public exploit
A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature.
-
Unscored —CVE-2021-32156 Public exploit
A cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature.
-
Unscored —CVE-2022-26180 Public exploit
qdPM 9.2 allows Cross-Site Request Forgery (CSRF) via the index.php/myAccount/update URI.
-
Unscored —CVE-2021-43009 Public exploit
A Cross Site Scripting (XSS) vulnerability exists in OpServices OpMon through 9.11 via the search parameter in the requ…
-
High 7.3CVE-2022-26671 Public exploit
TAIWAN SECOM CO., LTD., a xDoor Access Control and Personnel Attendance Management system - Hard-coded Credentials
Taiwan Secom Dr.ID Access Control system’s login page has a hard-coded credential in the source code. An unauthenticated remote attacker can use the hard-coded credential to acquire partial system information and modify system setting to cause partial disrupt…
-
Unscored —
An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system fi…
-
Unscored —
An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts.
-
Unscored —
Insecure handling of a download function leads to disclosure of internal files due to path traversal with root privileg…
-
Medium 5.4CVE-2021-46416 Public exploit
Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups acc…
-
Unscored —CVE-2021-40375 Public exploit
Apperta Foundation OpenEyes 3.5.1 allows remote attackers to view the sensitive information of patients without having …
-
Unscored —CVE-2021-40374 Public exploit
A stored cross-site scripting (XSS) vulnerability was identified in Apperta Foundation OpenEyes 3.5.1. Updating a patie…
-
Unscored —
Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remot…
-
High 8.8CVE-2022-24780 Public exploit
Code Injection in Combodo iTop
Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user priv…
-
Unscored —CVE-2020-23349 Public exploit
An intent redirection issue was doscovered in Sina Weibo Android SDK 4.2.7 (com.sina.weibo.sdk.share.WbShareTransActivi…
-
Unscored —CVE-2022-23909 Public exploit
There is an unquoted service path in Sherpa Connector Service (SherpaConnectorService.exe) 2020.2.20328.2050. This migh…
-
High 7.5
Files or Directories Accessible to External Parties in Adminer
Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by requesting the Adminer to connect to a remote MySQL database.
-
Unscored —CVE-2022-25584 Public exploit
Seyeon Tech Co., Ltd FlexWATCH FW3170-PS-E Network Video System 4.23-3000_GY allows attackers to access sensitive infor…
-
Unscored —CVE-2022-26982 Public exploit
SimpleMachinesForum 2.1.1 and earlier allows remote authenticated administrators to execute arbitrary code by inserting…
-
High 7.2CVE-2022-26986 Public exploit
SQL injection in ImpressCMS
SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker to read and modify the sensitive information from the database used by the application. If misconfigured, an attacker can …
-
High 8.7
Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 befo…
-
Critical 9.1
A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/E…
-
High 8.6
Kyocera Net View Address Book Exposure
Kyocera multifunction printers running vulnerable versions of Net View unintentionally expose sensitive user information, including usernames and passwords, through an insufficiently protected address book export function.
-
High 7.5
Path Traversal in Moment.js
Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is direct…
-
Unscored —
Mediaserver.exe in ALLMediaServer 1.6 has a stack-based buffer overflow that allows remote attackers to execute arbitra…
-
Low 3.5CVE-2022-0088 Public exploit
Cross-Site Request Forgery (CSRF) in yourls/yourls
Cross-Site Request Forgery (CSRF) in GitHub repository yourls/yourls prior to 1.8.3.
-
Critical 9.8
Remote code injection in dompdf/dompdf
Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).
-
Medium 5.5CVE-2022-1068 Public exploit
Modbus Tools Modbus Slave Stack-Based Buffer Overflow
Modbus Tools Modbus Slave (versions 7.4.2 and prior) is vulnerable to a stack-based buffer overflow in the registration field. This may cause the program to crash when a long character string is used.
-
Critical 9.8
Remote Code Execution in Spring Framework
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot…
KEV Apr 4, 2022 -
Unscored —
Cross-site scripting (XSS) via Host Header injection in PKP Open Journals System 2.4.8 >= 3.3 allows remote attackers t…
-
Critical 9.8
Spring Cloud Function Code Injection with a specially crafted SpEL as a routing expression
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local …
KEV Aug 25, 2022 -
High 7.8CVE-2022-27772 Public exploit
Temporary Directory Hijacking to Local Privilege Escalation Vulnerability in org.springframework.boot:spring-boot
spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only…
-
Unscored —CVE-2021-39749 Public exploit
In WindowManager, there is a possible way to start non-exported and protected activities due to a missing permission ch…
-
Unscored —CVE-2021-3456 Public exploit
An improper authorization handling flaw was found in Foreman. The Salt plugin for the smart-proxy allows foreman client…
-
Medium 6.8CVE-2022-1163 Public exploit
Cross-site Scripting (XSS) - Stored in mineweb/minewebcms
Cross-site Scripting (XSS) - Stored in GitHub repository mineweb/minewebcms prior to next.
-
Unscored —CVE-2022-24693 Public exploit
Baicells Nova436Q and Neutrino 430 devices with firmware through QRTB 2.7.8 have hardcoded credentials that are easily …
-
Medium 6.5
The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious ac…
KEV Jul 17, 2024 -
Unscored —CVE-2021-43701 Public exploit
CSZ CMS 1.2.9 has a Time and Boolean-based Blind SQL Injection vulnerability in the endpoint /admin/export/getcsv/artic…
-
Medium 5.3CVE-2022-1077 Public exploit
TEM FLEX-1080/FLEX-1085 Log information disclosure
A vulnerability was found in TEM FLEX-1080 and FLEX-1085 1.6.0. It has been declared as problematic. This vulnerability log.cgi of the component Log Handler. A direct request leads to information disclosure of hardware information. The attack can be initiated…