Lucene search
+L
AttackerkbMost viewed

89134 matches found

ATTACKERKB
ATTACKERKB
added 2026/03/01 3:2 a.m.27 views

CVE-2026-3380

A vulnerability was found in Tenda F453 1.0.0.3. This issue affects the function frmL7ImForm of the file /goform/L7Im. The manipulation of the argument page results in buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used...

9CVSS7.5AI score0.00773EPSS
SaveExploits1References5Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/02/26 2:58 p.m.27 views

CVE-2026-26077

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, several webhook endpoints SendGrid, Mailjet, Mandrill, Postmark, SparkPost in the WebhooksController accepted requests without a valid authentication token when no token was configured. This...

6.5CVSS5.3AI score0.0024EPSS
SaveExploits0References2Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/02/09 5:2 a.m.27 views

CVE-2026-2216

A flaw has been found in rachelos WeRSS we-mp-rss up to 1.4.8. Impacted is the function downloadexportfile of the file apis/tools.py. Executing a manipulation of the argument filename can lead to path traversal. The attack can be launched remotely. The exploit has been published and may be used...

5.3CVSS5AI score0.00292EPSS
SaveExploits0References4Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/02/08 11:2 p.m.27 views

CVE-2026-2193

A vulnerability was detected in D-Link DI-7100G C1 24.04.18D1. Affected by this issue is the function setjhttpdinfo. Performing a manipulation of the argument usbusername results in command injection. Remote exploitation of the attack is possible...

6.5CVSS6.5AI score0.03333EPSS
SaveExploits1References6Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/02/08 4:32 p.m.27 views

CVE-2026-2163

A vulnerability was identified in D-Link DIR-600 up to 2.15WWb02. This vulnerability affects unknown code of the file ssdp.cgi. Such manipulation of the argument HTTPST/REMOTEADDR/REMOTEPORT/SERVERID leads to command injection. The attack may be launched remotely. The exploit is publicly availabl...

5.8CVSS5.1AI score0.0568EPSS
SaveExploits1References6Affected Software1
ATTACKERKB
ATTACKERKB
added 2025/05/13 12:0 a.m.27 views

CVE-2025-32701

Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

7.8CVSS7.6AI score0.01297EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2025/03/26 12:0 a.m.27 views

CVE-2025-2783

Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. Chromium security severity: High Recent assessments: cbeek-r7 at October 29, 2025 12:50pm UTC reported:...

8.3CVSS8.8AI score0.08404EPSS
SaveExploits7References4
ATTACKERKB
ATTACKERKB
added 2025/01/09 12:0 a.m.27 views

CVE-2024-53704

An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication. Recent assessments: remmons-r7 at January 28, 2025 3:26pm UTC reported: On January 7, 2025, SonicWall announced an authentication bypass affecting SonicOS, the...

9.8CVSS9.7AI score0.95132EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2024/08/21 12:0 a.m.27 views

CVE-2024-28987

The SolarWinds Web Help Desk WHD software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data. Recent assessments: sfewer-r7 at November 22, 2024 4:16pm UTC reported: SolarWinds Web Help Desk is described as an...

9.1CVSS9.7AI score0.93208EPSS
SaveExploits6References3
ATTACKERKB
ATTACKERKB
added 2024/08/13 12:0 a.m.27 views

CVE-2024-38189

Microsoft Project Remote Code Execution Vulnerability Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

8.8CVSS7.5AI score0.08194EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2024/05/21 3:15 p.m.27 views

CVE-2021-47328

In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi: Fix conn use after free during resets If we haven't done a unbind target call we can race where iscsiconnteardown wakes up the EH thread and then frees the conn while those threads are still accessing the conn ehwait...

7.8CVSS6.1AI score0.00759EPSS
SaveExploits0References7Affected Software1
ATTACKERKB
ATTACKERKB
added 2024/04/04 12:0 a.m.27 views

CVE-2024-3272

UNSUPPORTED WHEN ASSIGNED A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nassharing.cgi of the component HTTP GET Request Handler. The...

10CVSS7.2AI score0.98038EPSS
SaveExploits2References5
ATTACKERKB
ATTACKERKB
added 2023/10/22 3:15 a.m.27 views

CVE-2023-46298

Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN...

7.5CVSS5.8AI score0.01284EPSS
SaveExploits1References4
ATTACKERKB
ATTACKERKB
added 2022/04/12 3:19 p.m.27 views

CVE-2022-21803

This affects the package nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set function, that is responsible for setting the configuration properties, is vulnerable to Prototype Pollution. By providing a crafted...

7.5CVSS7.1AI score0.01753EPSS
SaveExploits1References5
ATTACKERKB
ATTACKERKB
added 2022/03/10 11:15 p.m.27 views

CVE-2022-0815

Improper access control vulnerability in McAfee WebAdvisor Chrome and Edge browser extensions up to 8.1.0.1895 allows a remote attacker to gain access to McAfee WebAdvisor settings and other details about the user’s system. This could lead to unexpected behaviors including; settings being changed...

7.5CVSS5.5AI score0.00998EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2022/02/17 7:15 p.m.27 views

CVE-2022-22912

Prototype pollution vulnerability via .parse in Plist before v3.0.4 allows attackers to cause a Denial of Service DoS and may lead to remote code execution...

9.8CVSS7.6AI score0.02553EPSS
SaveExploits1References2
ATTACKERKB
ATTACKERKB
added 2021/03/02 8:15 p.m.27 views

CVE-2021-21255

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI version 9.5.3, it was possible to switch entities with IDOR from a logged in user. This is fixed in version 9.5.4...

5.8CVSS6.8AI score0.00854EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2020/09/09 12:0 a.m.27 views

CVE-2020-2040

A buffer overflow vulnerability in PAN-OS allows an unauthenticated attacker to disrupt system processes and potentially execute arbitrary code with root privileges by sending a malicious request to the Captive Portal or Multi-Factor Authentication interface. This issue impacts: All versions of...

10CVSS5.7AI score0.03937EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2020/08/06 12:0 a.m.27 views

CVE-2020-7360

An Uncontrolled Search Path Element CWE-427 vulnerability in SmartControl version 4.3.15 and versions released before April 15, 2020 may allow an authenticated user to escalate privileges by placing a specially crafted DLL file in the search path. This issue was fixed in version 1.0.7, which was...

7.4CVSS1.3AI score0.00487EPSS
SaveExploits1References2
ATTACKERKB
ATTACKERKB
added 2020/06/09 12:0 a.m.27 views

CVE-2020-12004

The affected product lacks proper authentication required to query the server on the Ignition 8 Gateway versions prior to 8.0.10 and Ignition 7 Gateway versions prior to 7.9.14, allowing an attacker to obtain sensitive information. Recent assessments: cdelafuente-r7 at June 26, 2020 11:13am UTC...

7.5CVSS8.5AI score0.20208EPSS
SaveExploits4References3
ATTACKERKB
ATTACKERKB
added 2020/05/08 12:0 a.m.27 views

CVE-2020-11530

A blind SQL injection vulnerability is present in Chop Slider 3, a WordPress plugin. The vulnerability is introduced in the id GET parameter supplied to getscript/index.php, and allows an attacker to execute arbitrary SQL queries in the context of the WP database user. Recent assessments: h00die ...

9.8CVSS1.1AI score0.95657EPSS
SaveExploits9References6
ATTACKERKB
ATTACKERKB
added 2020/04/27 12:0 a.m.27 views

CVE-2020-12138

AMD ATI atillk64.sys 5.11.9.0 allows low-privileged users to interact directly with physical memory by calling one of several driver routines that map physical memory into the virtual address space of the calling process. This could enable low-privileged users to achieve NT AUTHORITY\SYSTEM...

9CVSS2.4AI score0.03322EPSS
SaveExploits1References3
ATTACKERKB
ATTACKERKB
added 2020/04/08 12:0 a.m.27 views

CVE-2020-1985

Incorrect Default Permissions on C:\Programdata\Secdo\Logs folder in Secdo allows local authenticated users to overwrite system files and gain escalated privileges. This issue affects all versions Secdo for Windows. Recent assessments: xFreed0m at April 10, 2020 3:06pm UTC reported: CVE-2020-1985...

7.8CVSS1.8AI score0.00255EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2020/03/11 12:0 a.m.27 views

CVE-2020-10181

goform/formEMR30 in Sumavision Enhanced Multimedia Router EMR 3.0.4.27 allows creation of arbitrary users with elevated privileges administrator on a device, as demonstrated by a setString=newuseradministrator123456 request. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value:...

9.8CVSS9.4AI score0.14666EPSS
SaveExploits5References4
ATTACKERKB
ATTACKERKB
added 2020/03/08 12:0 a.m.27 views

CVE-2020-10225

An unauthenticated file upload vulnerability has been identified in admin/gallery.php in PHPGurukul Job Portal 1.0. The vulnerability could be exploited by an unauthenticated remote attacker to upload content to the server, including PHP files, which could result in command execution. Recent...

9.8CVSS2.6AI score0.04346EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2020/03/08 12:0 a.m.27 views

CVE-2020-10224

An unauthenticated file upload vulnerability has been identified in adminadd.php in PHPGurukul Online Book Store 1.0. The vulnerability could be exploited by an unauthenticated remote attacker to upload content to the server, including PHP files, which could result in command execution. Recent...

9.8CVSS5.2AI score0.05474EPSS
SaveExploits1References3
ATTACKERKB
ATTACKERKB
added 2020/02/22 10:15 p.m.27 views

CVE-2020-9340

fauzantrif eLection 2.0 has SQL Injection via the admin/ajax/opkandidat.php id parameter...

7.2CVSS7.4AI score0.0104EPSS
SaveExploits2References2
ATTACKERKB
ATTACKERKB
added 2020/02/20 12:0 a.m.27 views

CVE-2020-3158

A vulnerability in the High Availability HA service of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to access a sensitive part of the system with a high-privileged account. The vulnerability is due to a system account that has a default and static password...

9.8CVSS0.3AI score0.02582EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2020/02/13 12:0 a.m.27 views

RCE in LibreOffice and OpenOffice via the Apache UNO API

LibreOffice and OpenOffice are vulnerable to RCE via the Apache UNO API if either program is running as a listener on the host machine. Recent assessments: space-r7 at September 12, 2019 6:07pm UTC reported: Details The soffice binary allows passing arguments in order to listen on a host ip and...

1.4AI score
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2020/02/10 12:0 a.m.27 views

CVE-2019-17517

The Bluetooth Low Energy implementation on Dialog Semiconductor SDK through 5.0.4 for DA14580/1/2/3 devices does not properly restrict the L2CAP payload length, allowing attackers in radio range to cause a buffer overflow via a crafted Link Layer packet. Recent assessments: pbarry25 at April 25,...

6.1CVSS8.1AI score0.00629EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2019/10/28 12:0 a.m.27 views

CVE-2019-18187

Trend Micro OfficeScan versions 11.0 and XG 12.0 could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server, which could potentially lead to remote code execution RCE. The remote process...

7.5CVSS7.9AI score0.25125EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2019/08/29 12:0 a.m.27 views

CVE-2019-13608

Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 3.12.4000, and 7.6 LTSR before CU8 3.0.8000 allows XXE attacks. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

7.5CVSS3.5AI score0.30041EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2019/03/05 12:0 a.m.27 views

CVE-2019-6223

A logic issue existed in the handling of Group FaceTime calls. The issue was addressed with improved state management. This issue is fixed in iOS 12.1.4, macOS Mojave 10.14.3 Supplemental Update. The initiator of a Group FaceTime call may be able to cause the recipient to answer. Recent...

7.5CVSS2.3AI score0.02629EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2018/11/06 12:0 a.m.27 views

CVE-2018-14667

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language EL injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData. Recen...

9.8CVSS8.3AI score0.74171EPSS
SaveExploits6References9
ATTACKERKB
ATTACKERKB
added 2018/03/27 12:0 a.m.28 views

CVE-2017-12319

A vulnerability in the Border Gateway Protocol BGP over an Ethernet Virtual Private Network EVPN for Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service DoS condition, or potentially corrupt the BGP routing table,...

7.1CVSS2.2AI score0.05278EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2018/03/08 12:0 a.m.27 views

CVE-2018-0147

A vulnerability in Java deserialization used by Cisco Secure Access Control System ACS prior to release 5.8 patch 9 could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by...

10CVSS5.5AI score0.18326EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2016/10/14 12:0 a.m.27 views

CVE-2016-3298

Microsoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow remote attackers to determine the existence of arbitrary files via a crafted web site, aka “Internet Explorer Information Disclosure...

6.5CVSS5.5AI score0.23478EPSS
SaveExploits0References5
ATTACKERKB
ATTACKERKB
added 2016/06/17 12:0 a.m.27 views

CVE-2016-3643

SolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by leveraging a misconfiguration of sudo, as demonstrated by “sudo cat /etc/passwd.” Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

7.8CVSS7.7AI score0.03704EPSS
SaveExploits5References5
ATTACKERKB
ATTACKERKB
added 2016/04/21 12:0 a.m.27 views

CVE-2016-3427

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assesse...

10CVSS8.4AI score0.92334EPSS
SaveExploits1References77
ATTACKERKB
ATTACKERKB
added 2015/06/10 12:0 a.m.27 views

CVE-2015-1770

Microsoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka “Microsoft Office Uninitialized Memory Use Vulnerability.” Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

9.3CVSS8.8AI score0.35105EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2015/01/23 12:0 a.m.27 views

CVE-2015-0311

Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in January 2015. Recent assessments:...

10CVSS9.8AI score0.8582EPSS
SaveExploits5References15
ATTACKERKB
ATTACKERKB
added 2015/01/23 12:0 a.m.27 views

CVE-2015-0310

Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before 11.2.202.438 on Linux does not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism on Windows, and have an unspecified impact on...

10CVSS1.7AI score0.15217EPSS
SaveExploits0References9
ATTACKERKB
ATTACKERKB
added 2014/12/10 12:0 a.m.27 views

CVE-2014-9163

Stack-based buffer overflow in Adobe Flash Player before 13.0.0.259 and 14.x and 15.x before 15.0.0.246 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in December 2014. Recent assessments: gwillcox-...

10CVSS7.8AI score0.20356EPSS
SaveExploits1References2
ATTACKERKB
ATTACKERKB
added 2014/08/12 12:0 a.m.27 views

CVE-2014-0546

Adobe Reader and Acrobat 10.x before 10.1.11 and 11.x before 11.0.08 on Windows allow attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context, via unspecified vectors. Recent assessments: gwillcox-r7 at November 22, 2020 3:25am UTC reported...

10CVSS6.6AI score0.2233EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2014/05/23 12:0 a.m.27 views

CVE-2013-1668

The uploadFile function in upload/index.php in CosCMS before 1.822 allows remote administrators to execute arbitrary commands via shell metacharacters in the name of an uploaded file. Recent assessments: wchen-r7 at September 12, 2019 6:08pm UTC reported: In fact, doesn’t seem like the user shoul...

8.5CVSS0.6AI score0.06977EPSS
SaveExploits5References7
ATTACKERKB
ATTACKERKB
added 2013/04/17 12:0 a.m.27 views

CVE-2013-2423

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented...

4.3CVSS5AI score0.85333EPSS
SaveExploits7References18
ATTACKERKB
ATTACKERKB
added 2013/02/14 12:0 a.m.27 views

CVE-2013-0641

Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute arbitrary code via a crafted PDF document, as exploited in the wild in February 2013. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value...

9.3CVSS7.8AI score0.32449EPSS
SaveExploits0References13
ATTACKERKB
ATTACKERKB
added 2012/12/03 12:0 a.m.27 views

CVE-2012-5611 MySQL Buffer Overflow

Stack-based buffer overflow in the aclget function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53 and other versions through 5.1.66, and MariaDB 5.5.2.x before 5.5.28a, 5.3.x before 5.3.11, 5.2.x before 5.2.13 and 5.1.x before 5.1.66, allows remote authenticated users to...

6.5CVSS4.1AI score0.23956EPSS
SaveExploits3References13
ATTACKERKB
ATTACKERKB
added 2009/08/19 5:30 p.m.27 views

CVE-2009-2055

Cisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service session reset via a BGP UPDATE message with an invalid attribute, as demonstrated in the wild on 17 August 2009...

5.9CVSS5.3AI score0.03326EPSS
SaveExploits1References4
ATTACKERKB
ATTACKERKB
added 2026/07/04 11:54 a.m.26 views

CVE-2026-53361

In the Linux kernel, the following vulnerability has been resolved: afunix: Set gcinprogress to true in unixgc. Igor Ushakov reported that unixgc could run with gcinprogress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unixschedulegc...

5.8AI score0.00124EPSS
SaveExploits0References5Affected Software1
Total number of security vulnerabilities5000