Lucene search
+L
AttackerkbMost viewed

96138 matches found

ATTACKERKB
ATTACKERKB
added 2023/05/23 1:15 a.m.21 views

CVE-2023-31741

There is a command injection vulnerability in the Linksys E2000 router with firmware version 1.0.06. If an attacker gains web management privileges, they can inject commands into the post request parameters wlssid, wlant, wlrate, WLattenctl, ttcpnum, ttcpsize in the httpd s StartEPI function,...

7.2CVSS5.8AI score0.02354EPSS
SaveExploits1References3
ATTACKERKB
ATTACKERKB
added 2023/01/17 6:15 a.m.21 views

CVE-2022-23816

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none...

6.4AI score
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2023/01/10 10:15 p.m.21 views

CVE-2023-21774

Windows Kernel Elevation of Privilege Vulnerability...

7.8CVSS7.1AI score0.0072EPSS
SaveExploits0References4Affected Software25
ATTACKERKB
ATTACKERKB
added 2023/01/10 10:15 p.m.21 views

CVE-2023-21752

Windows Backup Service Elevation of Privilege Vulnerability...

7.1CVSS7.1AI score0.05327EPSS
SaveExploits2References3Affected Software10
ATTACKERKB
ATTACKERKB
added 2022/11/25 5:15 p.m.21 views

CVE-2022-45218

Human Resource Management System v1.0.0 was discovered to contain a cross-site scripting XSS vulnerability. This vulnerability is triggered via a crafted payload injected into an authentication error message...

6.1CVSS6.2AI score0.00439EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2022/08/12 8:15 p.m.21 views

CVE-2022-37397

An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymous or unauthenticated LDAP binding is enabled, it allows bypass of authentication with an empty password...

9.8CVSS7.4AI score0.00868EPSS
SaveExploits0References2Affected Software1
ATTACKERKB
ATTACKERKB
added 2022/08/12 8:15 p.m.21 views

CVE-2022-2622

Insufficient validation of untrusted input in Safe Browsing in Google Chrome on Windows prior to 104.0.5112.79 allowed a remote attacker to bypass download restrictions via a crafted file...

6.5CVSS6.9AI score0.00674EPSS
SaveExploits0References6
ATTACKERKB
ATTACKERKB
added 2022/07/29 8:15 p.m.21 views

CVE-2022-2323

Improper neutralization of special elements used in a user input allows an authenticated malicious user to perform remote code execution in the host system. This vulnerability impacts SonicWall Switch 1.1.1.0-2s and earlier versions...

8.8CVSS7.4AI score0.06053EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2022/07/23 12:15 a.m.21 views

CVE-2022-1129

Inappropriate implementation in Full Screen Mode in Google Chrome on Android prior to 100.0.4896.60 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

6.5CVSS6.8AI score0.00801EPSS
SaveExploits1References4
ATTACKERKB
ATTACKERKB
added 2022/07/17 11:15 p.m.21 views

CVE-2022-31202

The export function in SoftGuard Web SGW before 5.1.5 allows directory traversal to read an arbitrary local file via export or man.tcl...

6.5CVSS6.7AI score0.01258EPSS
SaveExploits3References2
ATTACKERKB
ATTACKERKB
added 2022/06/28 10:15 p.m.21 views

CVE-2022-31884

Marval MSM v14.19.0.12476 has an Improper Access Control vulnerability which allows a low privilege user to delete other users API Keys including high privilege and the Administrator users API Keys...

6.5CVSS5.4AI score0.01154EPSS
SaveExploits1References4
ATTACKERKB
ATTACKERKB
added 2022/06/20 11:15 a.m.21 views

CVE-2022-1895

The underConstruction WordPress plugin before 1.20 does not have CSRF check in place when deactivating the construction mode, which could allow attackers to make a logged in admin perform such action via a CSRF attack...

4.3CVSS5.8AI score0.00421EPSS
SaveExploits2References2
ATTACKERKB
ATTACKERKB
added 2022/06/16 11:15 p.m.21 views

CVE-2022-30326

An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The network pre-shared key field on the web interface is vulnerable to XSS. An attacker can use a simple XSS payload to crash the basic.config page of the web interface...

10CVSS6.7AI score0.019EPSS
SaveExploits1References3
ATTACKERKB
ATTACKERKB
added 2022/06/16 6:15 p.m.21 views

CVE-2022-32545

A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned char' at coders/psd.c, when crafted or untrusted input is processed. This leads to a negative impact to application availability or other problems related to undefined behavior...

7.8CVSS6.7AI score0.01354EPSS
SaveExploits0References5
ATTACKERKB
ATTACKERKB
added 2022/06/15 11:00 p.m.21 views

CVE-2022-20733

A vulnerability in the login page of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to log in without credentials and access all roles without any restrictions. This vulnerability is due to exposed sensitive Security Assertion Markup Language SAML metadata. An...

9.8CVSS7.3AI score0.01068EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2022/06/15 10:15 p.m.21 views

CVE-2022-30159

Microsoft Office Information Disclosure Vulnerability...

5.5CVSS6.7AI score0.02637EPSS
SaveExploits0References3Affected Software6
ATTACKERKB
ATTACKERKB
added 2022/06/10 8:00 p.m.21 views

CVE-2022-25845

The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not...

9.8CVSS7.3AI score0.18882EPSS
SaveExploits6References8
ATTACKERKB
ATTACKERKB
added 2022/06/02 2:15 p.m.21 views

CVE-2022-31340

Simple Inventory System v1.0 is vulnerable to SQL Injection via /inventory/tableeditajax.php...

9.8CVSS7.4AI score0.01137EPSS
SaveExploits1References2
ATTACKERKB
ATTACKERKB
added 2022/05/10 9:15 p.m.21 views

CVE-2022-23279

Windows ALPC Elevation of Privilege Vulnerability...

7CVSS7.1AI score0.04861EPSS
SaveExploits0References3Affected Software7
ATTACKERKB
ATTACKERKB
added 2022/05/04 2:00 p.m.21 views

CVE-2022-29263

On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions prior to 7.2.1.5, the BIG-IP Edge Client Component...

7.8CVSS5.9AI score0.002EPSS
SaveExploits0References2Affected Software2
ATTACKERKB
ATTACKERKB
added 2022/04/25 5:15 p.m.21 views

CVE-2022-0477

An issue has been discovered in GitLab affecting all versions starting from 11.9 before 14.5.4, all versions starting from 14.6.0 before 14.6.4, all versions starting from 14.7.0 before 14.7.1. GitLab was not correctly handling bulk requests to delete existing packages from the package registries...

4.9CVSS5.4AI score0.00931EPSS
SaveExploits0References3Affected Software1
ATTACKERKB
ATTACKERKB
added 2022/04/25 4:16 p.m.21 views

CVE-2022-1392

The Videos sync PDF WordPress plugin through 1.7.4 does not validate the p parameter before using it in an include statement, which could lead to Local File Inclusion issues...

7.5CVSS7.2AI score0.1129EPSS
SaveExploits2References4
ATTACKERKB
ATTACKERKB
added 2022/04/22 6:15 p.m.21 views

CVE-2022-1440

Command Injection vulnerability in [email protected] in GitHub repository yarkeev/git-interface prior to 2.1.2. If both are provided by user input, then the use of a --upload-pack command-line argument feature of git is also supported for git clone, which would then allow for any operating syst...

10CVSS7.7AI score0.03928EPSS
SaveExploits1References3
ATTACKERKB
ATTACKERKB
added 2022/03/23 7:15 p.m.21 views

CVE-2022-26243

Tenda AC10-1200 v15.03.06.23EN was discovered to contain a buffer overflow in the setSmartPowerManagement function...

7.8CVSS6.1AI score0.01175EPSS
SaveExploits1References2
ATTACKERKB
ATTACKERKB
added 2022/03/18 11:15 a.m.21 views

CVE-2022-24655

A stack overflow vulnerability exists in the upnpd service in Netgear EX6100v1 201.0.2.28, CAX80 2.1.2.6, and DC112A 1.0.0.62, which may lead to the execution of arbitrary code without authentication...

7.8CVSS7.5AI score0.01124EPSS
SaveExploits1References4
ATTACKERKB
ATTACKERKB
added 2022/03/15 10:15 p.m.21 views

CVE-2022-26212

Totolink A830R V5.9c.4729B20191112, A3100R V4.1.2cu.5050B20200504, A950RG V4.1.2cu.5161B20200903, A800R V4.1.2cu.5137B20200730, A3000RU V5.9c.5185B20201128, and A810R V4.1.2cu.5182B20201026 were discovered to contain a command injection vulnerability in the function setDeviceName, via the deviceM...

9.8CVSS6.1AI score0.02779EPSS
SaveExploits1References2
ATTACKERKB
ATTACKERKB
added 2022/03/10 5:46 p.m.21 views

CVE-2022-24603

Luocms v2.0 is affected by SQL Injection in /admin/news/sortmod.php...

9.8CVSS7.4AI score0.01155EPSS
SaveExploits1References2
ATTACKERKB
ATTACKERKB
added 2022/03/09 5:15 p.m.21 views

CVE-2022-24455

Windows CD-ROM Driver Elevation of Privilege Vulnerability...

7.8CVSS7.1AI score0.00925EPSS
SaveExploits0References3Affected Software13
ATTACKERKB
ATTACKERKB
added 2022/03/02 9:15 p.m.21 views

CVE-2022-25045

Home Owners Collection Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel...

9.8CVSS5.8AI score0.01307EPSS
SaveExploits1References3
ATTACKERKB
ATTACKERKB
added 2022/02/15 8:15 p.m.21 views

CVE-2021-46264

Tenda AC Series Router AC11V02.03.01.104CN was discovered to contain a stack buffer overflow in the onlineList module. This vulnerability allows attackers to cause a Denial of Service DoS via crafted overflow data...

9.8CVSS8.1AI score0.01734EPSS
SaveExploits1References2
ATTACKERKB
ATTACKERKB
added 2022/02/09 11:15 p.m.21 views

CVE-2022-20028

In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06198663; Issue ID: ALPS06198663...

7.8CVSS7.2AI score0.00146EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2022/02/04 2:15 a.m.21 views

CVE-2021-46456

D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetWLanACLSettings. This vulnerability allows attackers to execute arbitrary commands via the wl0.0maclist parameter...

9.8CVSS8.2AI score0.03715EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2022/01/19 12:15 p.m.21 views

CVE-2022-21280

Vulnerability in the MySQL Cluster product of Oracle MySQL component: Cluster: General. Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physica...

6.3CVSS6.7AI score0.76548EPSS
SaveExploits0References4Affected Software1
ATTACKERKB
ATTACKERKB
added 2022/01/14 8:15 p.m.21 views

CVE-2022-22531

The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or downloaded files. This allows an attacker with basic user rights to run arbitrary script code, resulting in sensitive information being disclosed or modified...

8.1CVSS7.3AI score0.00849EPSS
SaveExploits0References3Affected Software1
ATTACKERKB
ATTACKERKB
added 2021/12/27 11:15 p.m.21 views

CVE-2021-45905

OpenWrt 21.02.1 allows XSS via the Traffic Rules Name screen...

5.4CVSS5.4AI score0.00515EPSS
SaveExploits1References2
ATTACKERKB
ATTACKERKB
added 2021/12/08 10:15 p.m.21 views

CVE-2021-43545

Using the Location API in a loop could have caused severe application hangs and crashes. This vulnerability affects Thunderbird 91.4.0, Firefox ESR 91.4.0, and Firefox 95...

6.5CVSS6.6AI score0.01597EPSS
SaveExploits0References11
ATTACKERKB
ATTACKERKB
added 2021/11/10 1:17 a.m.21 views

CVE-2021-36957

Windows Desktop Bridge Elevation of Privilege Vulnerability...

7.8CVSS7.2AI score0.00474EPSS
SaveExploits0References2Affected Software14
ATTACKERKB
ATTACKERKB
added 2021/10/13 12:00 a.m.21 views

CVE-2021-20123

A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges...

7.8CVSS6.8AI score0.90234EPSS
SaveExploits1References2
ATTACKERKB
ATTACKERKB
added 2021/09/07 7:15 a.m.21 views

CVE-2021-34147

The Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 does not properly handle the reception of a malformed LMP timing accuracy response followed by multiple reconnections to the link slave, allowing attackers to exhaust device BT resources and eventually...

6.5CVSS6.6AI score0.00581EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2021/08/31 10:00 p.m.21 views

CVE-2021-34571

Multiple Wireless M-Bus devices by Enbra use Hard-coded Credentials in Security mode 5 without an option to change the encryption key. An adversary can learn all information that is available in Enbra EWM...

6.5CVSS6.7AI score0.00226EPSS
SaveExploits0References2Affected Software1
ATTACKERKB
ATTACKERKB
added 2021/08/24 7:15 p.m.21 views

CVE-2021-30861

A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.0.1. A malicious application may bypass Gatekeeper checks...

5.5CVSS5.3AI score0.01224EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2021/08/05 8:15 p.m.21 views

CVE-2021-29973

Password autofill was enabled without user interaction on insecure websites on Firefox for Android. This was corrected to require user interaction with the page before a user's password would be entered by the browser's autofill functionality This bug only affects Firefox for Android. Other...

8.8CVSS6.7AI score0.00812EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2021/02/10 12:00 a.m.21 views

CVE-2021-23874

Arbitrary Process Execution vulnerability in McAfee Total Protection MTP prior to 16.0.30 allows a local user to gain elevated privileges and execute arbitrary code bypassing MTP self-defense. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

8.2CVSS7.9AI score0.01026EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2021/01/05 12:00 a.m.21 views

CVE-2020-17519

A change introduced in Apache Flink 1.11.0 and released in 1.11.1 and 1.11.2 as well allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users shou...

9.1CVSS7.3AI score0.97856EPSS
SaveExploits14References32
ATTACKERKB
ATTACKERKB
added 2020/09/23 12:00 a.m.21 views

Cisco Firepower Management Center Lightweight Directory Access Protocol Authentication Bypass Vulnerability

A vulnerability in the web-based management interface of Cisco Firepower Management Center FMC could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. The vulnerability is due to improper handling...

10CVSS1.2AI score0.0335EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2020/06/09 12:00 a.m.21 views

CVE-2020-13965

An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

6.3CVSS5.7AI score0.76596EPSS
SaveExploits2References12
ATTACKERKB
ATTACKERKB
added 2020/06/02 12:00 a.m.21 views

Windowsrcer IE/Edge Cross-URL vulnerabilities

Cross-Origin bugs in IE and Edge allow bypassing SOP in both browsers. 0-days released by James Lee @Windowsrcer Recent assessments: busterb at August 21, 2019 4:31pm UTC reported: A SOP bug requires the attacker to inject a resource into one domain, and be listening on another. Such a...

6.8AI score
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2020/04/15 12:00 a.m.21 views

CVE-2020-1094

An elevation of privilege vulnerability exists when the Windows Work Folder Service improperly handles file operations, aka ‘Windows Work Folder Service Elevation of Privilege Vulnerability’. Recent assessments: bac2binary at April 15, 2020 4:47pm UTC reported: The attack complexity is very less,...

7.8CVSS7.7AI score0.00914EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2020/03/23 11:15 p.m.21 views

CVE-2020-5252

The command-line "safety" package for Python has a potential security issue. There are two Python characteristics that allow malicious code to “poison-pill” command-line Safety package detection routines by disguising, or obfuscating, other malicious or non-secure packages. This vulnerability is...

5CVSS5.2AI score0.00366EPSS
SaveExploits0References5Affected Software1
ATTACKERKB
ATTACKERKB
added 2020/03/16 12:00 a.m.21 views

CVE-2020-5849

Unraid 6.8.0 allows authentication bypass. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

10CVSS8.7AI score0.95844EPSS
SaveExploits9References8
Total number of security vulnerabilities5000