4,286 results · Clear filters · Feed
-
High 7.0
Win32k Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then…
KEV Nov 3, 2021 -
High 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. An attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges. A…
-
High 7.0
Potential remote code execution in Apache Tomcat
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManage…
-
High 7.5
A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c
Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key…
-
High 7.4
Remote Code Execution in GLPI
In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality. Theoretically, this vulnerability can be exploited by an attacker without a valid account by using a CSRF. Due to the difficulty of the exploitation, the attack…
-
High 7.2CVE-2020-5248 Public exploit
Public GLPIKEY can be used to decrypt any data in GLPI
GLPI before before version 9.4.6 has a vulnerability involving a default encryption key. GLPIKEY is public and is used on every instance. This means anyone can decrypt sensitive data stored using this key. It is possible to change the key before installing GL…
-
High 7.8CVE-2018-20225 Public exploit
An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if …
-
High 7.2
Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute ar…
KEV Mar 10, 2023 -
High 7.3
Fonality Trixbox CE Post-Authentication Command Injection
An OS Command Injection vulnerability in the endpoint_devicemap.php component of Fonality Trixbox Community Edition allows an attacker to execute commands on the underlying operating system as the "asterisk" user. Note that Trixbox Community Edition has been …
-
High 7.5CVE-2020-10663 Public exploit
Unsafe object creation in json RubyGem
The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within…
-
High 7.1CVE-2019-15794 Public exploit
Reference counting error in overlayfs/shiftfs error path when used in conjuction with aufs
Overlayfs in the Linux kernel and shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, both replace vma->vm_file in their mmap handlers. On error the original value is not restored, and the reference is put for t…
-
High 7.1CVE-2019-15792 Public exploit
Type confusion in shiftfs
In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, shiftfs_btrfs_ioctl_fd_replace() calls fdget(oldfd), then without further checks passes the resulting file* into shiftfs_real_fdget(), which casts file->pri…
-
High 7.1CVE-2019-15791 Public exploit
Reference count underflow in shiftfs
In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, shiftfs_btrfs_ioctl_fd_replace() installs an fd referencing a file from the lower filesystem without taking an additional reference to that file. After the …
-
High 7.5
Segmentation fault in SSL_check_chain
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an i…
-
High 8.8
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperl…
KEV Nov 3, 2021 -
High 8.8CVE-2020-2944 Public exploit
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Common Desktop Environment). Supported versio…
-
High 7.5
The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Trave…
KEV Nov 3, 2021 -
High 8.1
Dell EMC Networking X-Series firmware versions 3.0.1.2 and older, Dell EMC Networking PC5500 firmware versions 4.1.0.22…
-
High 8.8
Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attack…
KEV Nov 3, 2021 -
High 7.8CVE-2020-8835 Public exploit
Linux kernel bpf verifier vulnerability
In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable …
-
High 8.8
Nexus Repository Manager 3 - Remote Code Execution
Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
KEV Nov 3, 2021 -
High 8.8
Remote Code Execution - JavaEL Injection (low privileged accounts) in Nexus Repository Manager
Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.
-
High 7.8CVE-2020-1712 Public exploit
A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are…
-
High 8.8CVE-2020-11113 Public exploit
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).
-
High 7.5CVE-2020-4276 Public exploit
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional is vulnerable to a privilege escalation vulnerabili…
-
High 8.6CVE-2020-1764 Public exploit
Hard coded cryptographic key in Kiali
A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possib…
-
High 7.2
FrozenNode Laravel-Administrator unrestricted file upload
FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution) via admin/tips_image/image/file_upload image upload with PHP content within a GIF image that has the .php extension. NOTE: this product is…
-
High 8.1
This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer…
-
High 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Arc…
-
High 8.3CVE-2020-6650 Public exploit
Arbitrary code execution through “Update Manager” Class
UPS companion software v1.05 & Prior is affected by ‘Eval Injection’ vulnerability. The software does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call e.g.”eval” in “Update Manager” class when software …
-
High 8.8CVE-2020-10673 Public exploit
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).
-
High 7.8
VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for…
KEV Nov 3, 2021 -
High 7.5
Unraid 6.8.0 allows authentication bypass.
KEV Nov 3, 2021 -
High 7.8
An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improper…
KEV Jan 28, 2022 -
High 7.8
In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient…
KEV Nov 3, 2021 -
High 7.8
In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. This could…
KEV Nov 3, 2021 -
High 7.2
setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in t…
KEV Mar 25, 2022 -
High 8.8
lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands v…
KEV Nov 3, 2021 -
High 7.6CVE-2020-5250 Public exploit
Possible information disclosure in PrestaShop
In PrestaShop before version 1.7.6.4, when a customer edits their address, they can freely change the id_address in the form, and thus steal someone else's address. It is the same with CustomerForm, you are able to change the id_customer and change all inform…
-
High 7.8
D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configur…
KEV Jun 29, 2023