Lucene search
+L
AttackerkbMost viewed

88453 matches found

ATTACKERKB
ATTACKERKB
added 2022/05/02 4:15 p.m.16 views

CVE-2022-1239

The HubSpot WordPress plugin before 8.8.15 does not validate the proxy URL given to the proxy REST endpoint, which could allow users with the editposts capability by default contributor and above to perform SSRF attacks...

8.8CVSS7.6AI score0.01396EPSS
SaveExploits2References2
ATTACKERKB
ATTACKERKB
added 2022/04/27 2:15 p.m.16 views

CVE-2022-27239

In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attackers gaining root privileges...

7.8CVSS6.2AI score0.00562EPSS
SaveExploits0References15
ATTACKERKB
ATTACKERKB
added 2022/04/25 5:15 p.m.16 views

CVE-2022-0477

An issue has been discovered in GitLab affecting all versions starting from 11.9 before 14.5.4, all versions starting from 14.6.0 before 14.6.4, all versions starting from 14.7.0 before 14.7.1. GitLab was not correctly handling bulk requests to delete existing packages from the package registries...

4.9CVSS5.4AI score0.00909EPSS
SaveExploits0References3Affected Software1
ATTACKERKB
ATTACKERKB
added 2022/04/25 4:16 p.m.16 views

CVE-2022-1392

The Videos sync PDF WordPress plugin through 1.7.4 does not validate the p parameter before using it in an include statement, which could lead to Local File Inclusion issues...

7.5CVSS7.2AI score0.1129EPSS
SaveExploits2References4
ATTACKERKB
ATTACKERKB
added 2022/04/19 9:15 p.m.16 views

CVE-2022-21466

Vulnerability in the Oracle Commerce Guided Search product of Oracle Commerce component: Tools and Frameworks. The supported version that is affected is 11.3.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Searc...

7.5CVSS7.1AI score0.01785EPSS
SaveExploits0References2Affected Software1
ATTACKERKB
ATTACKERKB
added 2022/04/15 7:15 p.m.16 views

CVE-2022-26901

Microsoft Excel Remote Code Execution Vulnerability...

7.8CVSS5.9AI score0.02583EPSS
SaveExploits0References3Affected Software10
ATTACKERKB
ATTACKERKB
added 2022/04/05 4:15 a.m.16 views

CVE-2022-1212

Use-After-Free in strescape in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited...

9.8CVSS8.4AI score0.0168EPSS
SaveExploits1References3
ATTACKERKB
ATTACKERKB
added 2022/04/01 11:15 p.m.16 views

CVE-2022-25159

Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5UC CPU all versions, Mitsubishi Electric MELSEC iQ-F series FX5UJ CPU all versions, Mitsubishi Electric MELSEC iQ-R series R00/01/02CPU all versions, Mitsubishi Electric MELSEC iQ-R series...

8.1CVSS6.9AI score0.02118EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2022/03/23 10:15 p.m.16 views

CVE-2022-22819

NXP LPC55S66JBD64, LPC55S66JBD100, LPC55S66JEV98, LPC55S69JBD64, LPC55S69JBD100, and LPC55S69JEV98 microcontrollers ROM version 1B have a buffer overflow in parsing SB2 updates before the signature is verified. This can allow an attacker to achieve non-persistent code execution via a crafted...

7.8CVSS7.7AI score0.01314EPSS
SaveExploits1References3
ATTACKERKB
ATTACKERKB
added 2022/03/23 11:15 a.m.16 views

CVE-2021-45756

Asus RT-AC68U 3.0.0.4.385.20633 and RT-AC5300 3.0.0.4.384.82072 are affected by a buffer overflow in blockingrequest.cgi...

9.8CVSS6.1AI score0.01213EPSS
SaveExploits1References4
ATTACKERKB
ATTACKERKB
added 2022/03/18 11:15 a.m.16 views

CVE-2022-24655

A stack overflow vulnerability exists in the upnpd service in Netgear EX6100v1 201.0.2.28, CAX80 2.1.2.6, and DC112A 1.0.0.62, which may lead to the execution of arbitrary code without authentication...

7.8CVSS7.5AI score0.01052EPSS
SaveExploits1References4
ATTACKERKB
ATTACKERKB
added 2022/03/15 10:15 p.m.16 views

CVE-2022-26992

Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the ddns function via the DdnsUserName, DdnsHostName, and DdnsPassword parameters. This vulnerability allows attackers to execute arbitrary commands...

9.8CVSS6.1AI score0.02908EPSS
SaveExploits1References2
ATTACKERKB
ATTACKERKB
added 2022/03/07 1:15 p.m.16 views

CVE-2022-0756

Missing Authorization in GitHub repository salesagility/suitecrm prior to 7.12.5...

6.5CVSS5.4AI score0.00619EPSS
SaveExploits1References3
ATTACKERKB
ATTACKERKB
added 2022/02/28 9:15 a.m.16 views

CVE-2022-23912

The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not sanitise and escape the id parameter before outputting it back in an attribute, leading to a Reflected cross-Site Scripting...

6.1CVSS6.4AI score0.00866EPSS
SaveExploits2References3
ATTACKERKB
ATTACKERKB
added 2022/02/24 7:15 p.m.16 views

CVE-2022-24232

A local file inclusion in Hospital Patient Record Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file...

7.8CVSS7.5AI score0.01526EPSS
SaveExploits1References2
ATTACKERKB
ATTACKERKB
added 2022/02/21 11:15 a.m.16 views

CVE-2022-0252

The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute in the Import admin dashboard, leading to a Reflected Cross-Site Scripting...

6.1CVSS6.3AI score0.00866EPSS
SaveExploits2References3
ATTACKERKB
ATTACKERKB
added 2022/02/14 10:15 p.m.16 views

CVE-2021-46462

njs through 0.7.1, used in NGINX, was discovered to contain a segmentation violation via njsobjectsetprototype in /src/njsobject.c...

7.5CVSS7.2AI score0.01677EPSS
SaveExploits1References4
ATTACKERKB
ATTACKERKB
added 2022/02/12 4:0 a.m.16 views

CVE-2022-22766

Hardcoded credentials are used in specific BD Pyxis products. If exploited, threat actors may be able to gain access to the underlying file system and could potentially exploit application files for information that could be used to decrypt application credentials or gain access to electronic...

7CVSS6AI score0.00228EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2022/02/05 2:15 a.m.16 views

CVE-2022-0437

Cross-site Scripting XSS - DOM in NPM karma prior to 6.3.14...

6.1CVSS5.9AI score0.15054EPSS
SaveExploits1References4
ATTACKERKB
ATTACKERKB
added 2022/02/04 2:15 a.m.16 views

CVE-2022-24157

Tenda AX3 v16.03.12.10CN was discovered to contain a stack overflow in the function formSetMacFilterCfg. This vulnerability allows attackers to cause a Denial of Service DoS via the deviceList parameter...

7.8CVSS7.2AI score0.01175EPSS
SaveExploits1References2
ATTACKERKB
ATTACKERKB
added 2022/01/28 12:0 a.m.16 views

CVE-2021-40407

An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.13620121102. At 1 or 2, based on DDNS type, the ddns-domain variable, that has the value of the domain parameter provided through the SetDdns API, is not validated properly. This...

9.1CVSS7.6AI score0.46986EPSS
SaveExploits1References2
ATTACKERKB
ATTACKERKB
added 2022/01/27 9:15 p.m.16 views

CVE-2021-46498

Jsish v3.5.0 was discovered to contain a heap-use-after-free via jsiwswebsocketObjFree in src/jsiWebSocket.c. This vulnerability can lead to a Denial of Service DoS...

5.5CVSS5.9AI score0.00638EPSS
SaveExploits1References2
ATTACKERKB
ATTACKERKB
added 2022/01/19 12:15 p.m.16 views

CVE-2022-21311

Vulnerability in the MySQL Cluster product of Oracle MySQL component: Cluster: General. Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physica...

2.9CVSS6.6AI score0.01553EPSS
SaveExploits0References4Affected Software1
ATTACKERKB
ATTACKERKB
added 2022/01/19 12:15 p.m.16 views

CVE-2022-21292

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Samples. Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Serve...

7.5CVSS6.9AI score0.01731EPSS
SaveExploits0References2Affected Software1
ATTACKERKB
ATTACKERKB
added 2021/12/28 2:15 p.m.16 views

CVE-2021-45903

A persistent cross-site scripting XSS issue in the web interface of SuiteCRM before 7.10.35, and 7.11.x and 7.12.x before 7.12.2, allows a remote attacker to introduce arbitrary JavaScript via attachments upload, a different vulnerability than CVE-2021-39267 and CVE-2021-39268...

6.1CVSS5.4AI score0.01121EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2021/12/15 2:15 p.m.16 views

CVE-2021-4116

yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

6.6CVSS6.3AI score0.00456EPSS
SaveExploits1References3
ATTACKERKB
ATTACKERKB
added 2021/12/14 12:0 a.m.16 views

CVE-2021-4044

Internally libssl in OpenSSL calls X509verifycert on the client side to verify a certificate supplied by a server. That function may return a negative return value to indicate an internal error for example out of memory. Such a negative return value is mishandled by OpenSSL and will cause an IO...

7.5CVSS7.3AI score0.50099EPSS
SaveExploits0References5
ATTACKERKB
ATTACKERKB
added 2021/08/31 12:0 a.m.16 views

Online Leave Management System SQL-Injection-Bypass-Authentication

Description: The OLMS – PHP by: oretnom23 v1.0 is vulnerable in the application /leavesystem/classes/Login.php from SQL-Injection-Bypass-Authentication m0re info: . The parameter username from the login form is not protected correctly and there is no security and escaping from malicious payloads...

7.5AI score
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2021/06/03 9:15 p.m.16 views

CVE-2020-35973

An issue was discovered in zzcms2020. There is a XSS vulnerability that can insert and execute JS code arbitrarily via /user/manage.php...

5.4CVSS5.6AI score0.00613EPSS
SaveExploits1References2
ATTACKERKB
ATTACKERKB
added 2021/05/11 11:0 p.m.16 views

CVE-2021-28560

Acrobat Reader DC versions versions 2021.001.20150 and earlier, 2020.001.30020 and earlier and 2017.011.30194 and earlier are affected by a Heap-based Buffer Overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of...

8.8CVSS6.3AI score0.66918EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2020/06/16 12:0 a.m.17 views

CVE-2020-13162

A time-of-check time-of-use vulnerability in PulseSecureService.exe in Pulse Secure Client versions prior to 9.1.6 down to 5.3 R70 for Windows which runs as NT AUTHORITY/SYSTEM allows unprivileged users to run a Microsoft Installer executable with elevated privileges. Recent assessments:...

7CVSS6.4AI score0.00793EPSS
SaveExploits3References11
ATTACKERKB
ATTACKERKB
added 2020/06/05 12:0 a.m.16 views

CVE-2017-1135

RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value:...

5.6AI score
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2020/02/13 12:0 a.m.16 views

Novell Unicode Buffer Overflow

The Novell Messenger Client is prone to an overflow condition. The application fails to properly sanitize user-supplied input resulting in a stack-based buffer overflow. With a specially crafted contact list file containing an arbitrary ‘name’ value of a ‘folder’ tag, a context-dependent attacker...

1.1AI score
SaveExploits0
ATTACKERKB
ATTACKERKB
added 2020/02/13 12:0 a.m.17 views

CVE-2019-3719

Dell support agent fails to properly identify the origin of updates. By DNS spoofing and crafted payloads, an attacker can serve up an executable file that the support agent will run as system. Recent assessments: bwatters-r7 at July 18, 2019 9:47pm UTC reported: As exploits go, being able to ser...

8CVSS1.3AI score0.16145EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2020/02/13 12:0 a.m.16 views

FlightGear flightgear/src/Environment/fgclouds.cxx Cloud Name Handling Remote Format String

FlightGear contains a format string flaw in flightgear/src/Environment/fgclouds.cxx. The issue is triggered as format string specifiers e.g. %s and %x are not properly sanitized in user-supplied input during the handling of a specially crafted cloud name. This may allow a remote attacker to cause...

0.1AI score
SaveExploits0
ATTACKERKB
ATTACKERKB
added 2019/10/06 12:0 a.m.16 views

CVE-2019-17240

bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Client-IP HTTP headers. Recent assessments: noraj at May 08, 2021 7:26pm UTC reported: This is just a security bypass allowing an attacker t...

9.8CVSS2.4AI score0.39598EPSS
SaveExploits9References7
ATTACKERKB
ATTACKERKB
added 2019/09/13 12:0 a.m.16 views

CVE-2019-11660

Privileges manipulation in Micro Focus Data Protector, versions 10.00, 10.01, 10.02, 10.03, 10.04, 10.10, 10.20, 10.30, 10.40. This vulnerability could be exploited by a low-privileged user to execute a custom binary with higher privileges. Recent assessments: pbarry-r7 at November 20, 2019 3:15p...

7.8CVSS2.8AI score0.07847EPSS
SaveExploits4References3
ATTACKERKB
ATTACKERKB
added 2018/03/16 2:29 p.m.16 views

CVE-2017-4030

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none...

5.8AI score
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2017/04/02 8:59 p.m.16 views

CVE-2016-8273

Huawei PC client software HiSuite 4.0.5.300OVE uses insecure HTTP for upgrade software package download and does not check the integrity of the software package before installing; an attacker can launch an MITM attack to interrupt or replace the downloaded software package and further compromise...

7.8CVSS5.6AI score0.0021EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2014/01/22 9:55 p.m.16 views

CVE-2014-0808

Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29th, 2015. If this vulnerability is exploited, a user of the affected shopping website may obtain other users' information by sending a crafted HTTP request...

9.1CVSS5.3AI score0.02245EPSS
SaveExploits0References8Affected Software2
ATTACKERKB
ATTACKERKB
added 2013/02/27 12:0 a.m.16 views

CVE-2013-0648

Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows remote attackers to execute arbitrary code via crafted...

9.3CVSS8AI score0.11094EPSS
SaveExploits0References6
ATTACKERKB
ATTACKERKB
added 2012/03/14 12:0 a.m.16 views

HP Data Protector Express 6.0.00.11974 dpwintdb.exe Buffer Overflow

Unspecified vulnerability in HP Data Protector Express aka DPX 5.0.00 before build 59287 and 6.0.00 before build 11974 allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors, aka ZDI-CAN-1498. Recent assessments: wchen-r7 at September 12, 2019 6:07pm UT...

10CVSS0.4AI score0.62305EPSS
SaveExploits8References1
ATTACKERKB
ATTACKERKB
added 2009/04/03 6:30 p.m.16 views

CVE-2009-0556

Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an an invalid index value that triggers memory corruption, as exploited in t...

9.3CVSS6.2AI score0.67539EPSS
SaveExploits5References19
ATTACKERKB
ATTACKERKB
added 5 days ago15 views

CVE-2026-63222

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the...

7.5CVSS5.9AI score0.0045EPSS
SaveExploits0References4Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/07/29 8:25 a.m.15 views

CVE-2026-58156

Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fi...

6.3CVSS5.8AI score0.00222EPSS
SaveExploits0References2Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/07/25 8:51 a.m.15 views

CVE-2026-64505

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check for header Add a length check for the rndis header in rndisrmhdr, to ensure that MessageType, MessageLength, DataOffset, and DataLength fields are present before they are accessed...

5.8AI score0.0022EPSS
SaveExploits0References9Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/07/25 8:51 a.m.15 views

CVE-2026-64458

In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: handle extreme intervals in damonhotscore Fix three issues in damonhotscore that comes from wrong handling of extreme zero or too high monitoring intervals user setup. When the user sets sampling interval zer...

5.6AI score0.0018EPSS
SaveExploits0References7Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/07/24 11:1 p.m.15 views

CVE-2026-66337

A flaw was found in libsoup. An unsigned integer underflow in the soupfilterinputstreamreaduntil function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client...

6.5CVSS6AI score0.00229EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2026/07/24 2:0 p.m.15 views

CVE-2026-55730

Reflected Cross-Site Scripting CWE-79 in LWEB802 in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser and perform actions with the victim's privileges via a crafted link containing a malicious project or...

8.7CVSS6.2AI score0.00358EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/07/21 9:39 p.m.15 views

CVE-2026-61338

Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contracts...

8.1CVSS7.1AI score0.00338EPSS
SaveExploits0References2Affected Software1
Total number of security vulnerabilities5000