4,914 results · Clear filters · Feed
-
Critical —
Mattermost Server exposes OAuth personal access tokens to attackers
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by using a registered OAuth application with personal access tokens.
-
Critical 9.8
bbPress unauthenticated privilege-escalation
An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled.
-
Critical 9.1
Knock Knock plugin IP Whitelist bypass via an X-Forwarded-For HTTP header
The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header.
-
Critical 9.8
WSO2 API Manager vulnerable to SSRF
WSO2 API Manager 3.0.0 does not properly restrict outbound network access from a Publisher node, opening up the possibility of SSRF to this node's entire intranet.
-
Critical 9.8
scikit-learn Deserialization of Untrusted Data
scikit-learn (aka sklearn) through 0.23.0 can unserialize and execute commands from an untrusted file that is passed to the joblib.load() function, if __reduce__ makes an os.system call. NOTE: third parties dispute this issue because the joblib.load() functio…
-
Critical 9.8
Maltego incorrectly shares a MISP connection across users in a remote-transform use case
MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case.
-
Critical 9.8
chrome-launcher subject to OS Command Injection
All versions of chrome-launcher allow execution of arbitrary commands, by controlling the $HOME environment variable in Linux operating systems.
-
Critical 9.8
SaltStack Salt Unauthenticated Remote Code Execution
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be u…
KEV Nov 3, 2021 -
Critical 9.8
AutoUpdater.NET allows XXE
AutoUpdater.cs in AutoUpdater.NET before 1.5.8 allows XXE.
-
Critical 9.8
eZ Publish Kernel and Legacy Unrestricted Upload of File with Dangerous Type
eZ Publish Kernel before 5.4.14.1, 6.x before 6.13.6.2, and 7.x before 7.5.6.2 and eZ Publish Legacy before 5.4.14.1, 2017 before 2017.12.7.2, and 2019 before 2019.03.4.2 allow remote attackers to execute arbitrary code by uploading PHP code, unless the vhost…
-
Critical 9.8
Deserialization of Untrusted Data in Liferay Portal
Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).
KEV Nov 3, 2021 -
Critical 9.8
Dolibarr Cross-site Scripting via the qty parameter in product/fournisseurs.php
Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen).
-
Critical 9.8
Improper Neutralization of Special Elements used in an OS Command in Blamer
Blamer versions prior to 1.0.1 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of the arguments provided to blamer.
-
Critical 9.8
Fat-Free Framework arbitrary code execution
In Fat-Free Framework 3.7.1, attackers can achieve arbitrary code execution if developers choose to pass user controlled input (e.g., $_REQUEST, $_GET, or $_POST) to the framework's Clear method.
-
Critical 9.8
SEOmatic for CraftCMS allows Server-Side Template Injection
The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller.
-
Critical 9.8
Deserialization of Untrusted Data in JYaml
JYaml through 1.3 allows remote code execution during deserialization of a malicious payload through the load() function. NOTE: this is a discontinued product.
-
Critical 9.8
promise-probe OS command injection vulnerability
promise-probe before 0.10.0 allows remote attackers to perform a command injection attack. The file, outputFile and options functions can be controlled by users without any sanitization.
-
Critical 9.8
omniauth-weibo-oauth2 included a code-execution backdoor inserted by a third party
The omniauth-weibo-oauth2 gem 0.4.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions through 0.4.5, and 0.5.1 and later, are unaffected.
-
Critical 9.8CVE-2020-3716 EPSS 14%
Magento deserialization vulnerability
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.
-
Critical 9.8
Magento security bypass vulnerability
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a security bypass vulnerability. Successful exploitation could lead to arbitrary code execution.
-
Critical 9.8
Dolibarr Improper Restriction of Excessive Authentication Attempts
The htdocs/index.php?mainmenu=home login page in Dolibarr 10.0.6 allows an unlimited rate of failed authentication attempts.
-
Critical 9.8
Plone Unauthenticated Write Vulnerability
A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission.
-
Critical 9.8
papercrop does not properly handle crop input
The papercrop gem before 0.3.0 for Ruby on Rails does not properly handle crop input.
-
Critical 9.8CVE-2019-17361 EPSS 15%
SaltStack Salt is vulnerable to command injection
In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.
-
Critical 9.8
HashBrown CMS RCE
A remote code execution issue was discovered in HashBrown CMS through 1.3.3. Server/Entity/Deployer/GitDeployer.js has a Service.AppService.exec call that mishandles the URL, repository, username, and password.
-
Critical 9.1
keycloak vulnerable to unauthorized login via mail server setup
A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be …
-
Critical 9.8
Buffer Copy without Checking Size of Input in Pillow
libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow.
-
Critical 9.8
Pivotal Spring Framework contains unsafe Java deserialization methods
Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authenticatio…
-
Critical 9.8
php-shellcommand command injection vulnerability
php-shellcommand versions before 1.6.1 have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.
-
Critical 9.8
SwiftNIO SSL arbitrary code execution vulnerability
The issue was addressed by signaling that an executable stack is not required. This issue is fixed in SwiftNIO SSL 2.4.1. A SwiftNIO application using TLS may be able to execute arbitrary code.
-
Critical 9.8
Treekill Enables OS Command Injection
A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker is able to control the input into the command.
-
Critical 9.8
phpMyAdmin unsanitized Git information
phpMyAdmin before 4.9.2 does not escape certain Git information, related to libraries/classes/Display/GitRevision.php and libraries/classes/Footer.php.
-
Critical 9.3
Keycloak Authentication Error
A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server (ldaps), in this case user authentication succeeds even if invalid password has entered.
-
Critical 9.3
Keycloak Authentication Error
A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or valid will be accepted.
-
Critical 9.8
Pimcore Access Control Issues
Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification.
-
Critical 9.8
Pimcore 2FA Vulnerable to Brute Forcing
Pimcore before 6.2.2 lacks brute force protection for the 2FA token.
-
Critical 9.8
Magento 2 Community Edition XML Injection
An XPath entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An attacker can craft a GET request to page cache block rendering module that gets passed to XML data processing engine without validation. …
-
Critical 9.8
Magento 2 Community Edition RCE Vulnerability
A remote code execution vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can insert a malicious payload through PageBuilder template methods.
-
Critical 9.8
Magento 2 Community Edition Insecure Component
An insecure component vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Magento 2 codebase leveraged outdated versions of HTTP specification abstraction implemented in symphony component.
-
Critical 9.8
Zend Framework Allows SQL Injection
Zend Framework before 2.2.10 and 2.3.x before 2.3.5 has Potential SQL injection in PostgreSQL Zend\Db adapter.