Lucene search
+L
AttackerkbMost viewed

87714 matches found

ATTACKERKB
ATTACKERKB
added 2022/06/06 11:15 p.m.15 views

CVE-2022-30927

A SQL injection vulnerability exists in Simple Task Scheduling System 1.0 when MySQL is being used as the application database. An attacker can issue SQL commands to the MySQL database through the vulnerable "id" parameter...

9.8CVSS7.4AI score0.01413EPSS
SaveExploits1References4
ATTACKERKB
ATTACKERKB
added 2022/06/02 2:15 p.m.15 views

CVE-2022-31346

Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/classes/Master.php?f=deleteservice...

9.8CVSS7.4AI score0.01105EPSS
SaveExploits1References2
ATTACKERKB
ATTACKERKB
added 2022/05/26 7:15 p.m.15 views

CVE-2022-26720

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Security Update 2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. A malicious application may be able to execute arbitrary code with kernel privileges...

9.3CVSS7.3AI score0.01125EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2022/05/24 7:15 p.m.15 views

CVE-2022-22977

VMware Tools for Windows12.0.0, 11.x.y and 10.x.y contains an XML External Entity XXE vulnerability. A malicious actor with non-administrative local user privileges in the Windows guest OS, where VMware Tools is installed, may exploit this issue leading to a denial-of-service condition or...

7.1CVSS7.1AI score0.00798EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2022/05/18 8:15 p.m.15 views

CVE-2022-30033

Tenda TX9 Pro V22.03.02.10 is vulnerable to Buffer Overflow via the functtion setIPv6Status in httpd module...

7.8CVSS5.9AI score0.01124EPSS
SaveExploits1References2
ATTACKERKB
ATTACKERKB
added 2022/05/11 4:15 p.m.15 views

CVE-2022-22975

An issue was discovered in the Pinniped Supervisor with either LADPIdentityProvider or ActiveDirectoryIdentityProvider resources. An attack would involve the malicious user changing the common name CN of their user entry on the LDAP or AD server to include special characters, which could be used ...

6.6CVSS6.8AI score0.00952EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2022/05/10 12:15 p.m.15 views

CVE-2022-29591

Tenda TX9 Pro 22.03.02.10 devices have a SetNetControlList buffer overflow...

10CVSS6.2AI score0.01361EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2022/05/04 2:0 p.m.15 views

CVE-2022-26890

On F5 BIG-IP Advanced WAF, ASM, and APM 16.1.x versions prior to 16.1.2.1, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when ASM or Advanced WAF, as well as APM, are configured on a virtual server, the ASM policy is configured with Sessi...

7.5CVSS5.9AI score0.00919EPSS
SaveExploits0References2Affected Software1
ATTACKERKB
ATTACKERKB
added 2022/05/03 8:15 p.m.15 views

CVE-2022-20097

In aee daemon, there is a possible information disclosure due to a race condition. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06383944; Issue ID: ALPS06383944...

4.7CVSS5.9AI score0.00077EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2022/04/29 4:15 p.m.15 views

CVE-2022-1227

A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to...

8.8CVSS7.5AI score0.04205EPSS
SaveExploits2References6
ATTACKERKB
ATTACKERKB
added 2022/04/25 10:15 a.m.15 views

CVE-2022-1457

Store XSS in title parameter executing at EditUser Page & EditProducto page in GitHub repository neorazorx/facturascripts prior to 2022.04. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltrate data or install malware on the...

9CVSS6.9AI score0.0074EPSS
SaveExploits1References3
ATTACKERKB
ATTACKERKB
added 2022/04/19 9:15 p.m.15 views

CVE-2022-21434

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable...

5.3CVSS6.5AI score0.02541EPSS
SaveExploits0References7
ATTACKERKB
ATTACKERKB
added 2022/04/05 4:15 a.m.15 views

CVE-2022-1212

Use-After-Free in strescape in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited...

9.8CVSS8.4AI score0.0168EPSS
SaveExploits1References3
ATTACKERKB
ATTACKERKB
added 2022/04/01 5:32 p.m.15 views

CVE-2022-24440

The package cocoapods-downloader before 1.6.0, from 1.6.2 and before 1.6.3 are vulnerable to Command Injection via git argument injection. When calling the Pod::Downloader.preprocessoptions function and using git, both the git and branch parameters are passed to the git ls-remote subcommand in a...

9.8CVSS7.2AI score0.02713EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2022/03/10 5:44 p.m.15 views

CVE-2021-44631

A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloudconfig/routerpost/resetcloudpwd feature, which allows malicous users to execute arbitrary code on the system via a crafted post request...

10CVSS7.7AI score0.02576EPSS
SaveExploits1References2
ATTACKERKB
ATTACKERKB
added 2022/03/07 9:15 a.m.15 views

CVE-2022-0426

The Product Feed PRO for WooCommerce WordPress plugin before 11.2.3 does not escape the rowCount parameter before outputting it back in an attribute via the wooseacategoriesdropdown AJAX action available to any authenticated user, leading to a Reflected Cross-Site Scripting...

5.4CVSS5.9AI score0.00649EPSS
SaveExploits2References3
ATTACKERKB
ATTACKERKB
added 2022/03/02 5:15 p.m.15 views

CVE-2022-25016

Home Owners Collection Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /studentattendance/index.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

9.8CVSS6.1AI score0.02015EPSS
SaveExploits1References2
ATTACKERKB
ATTACKERKB
added 2022/02/28 9:15 a.m.15 views

CVE-2022-23912

The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not sanitise and escape the id parameter before outputting it back in an attribute, leading to a Reflected cross-Site Scripting...

6.1CVSS6.4AI score0.00866EPSS
SaveExploits2References3
ATTACKERKB
ATTACKERKB
added 2022/02/19 12:15 a.m.15 views

CVE-2022-25137

A command injection vulnerability in the function recvSlaveUpgstatus of TOTOLINK Technology routers T6 V3Firmware T6V3V4.1.5cu.748B20211015 and T10 V2Firmware V4.1.8cu.5207B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet...

9.8CVSS7.5AI score0.02198EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2022/02/18 8:15 p.m.15 views

CVE-2021-46630

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within th...

5.5CVSS4.1AI score0.01612EPSS
SaveExploits0References3Affected Software1
ATTACKERKB
ATTACKERKB
added 2022/02/18 6:15 p.m.15 views

CVE-2022-25337

Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows injection attacks via image filenames...

9.8CVSS7.2AI score0.01059EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2022/02/15 8:15 p.m.15 views

CVE-2021-46264

Tenda AC Series Router AC11V02.03.01.104CN was discovered to contain a stack buffer overflow in the onlineList module. This vulnerability allows attackers to cause a Denial of Service DoS via crafted overflow data...

9.8CVSS8.1AI score0.01734EPSS
SaveExploits1References2
ATTACKERKB
ATTACKERKB
added 2022/02/15 5:15 p.m.15 views

CVE-2022-25195

A missing permission check in Jenkins autonomiq Plugin 1.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials...

4.3CVSS5.8AI score0.0055EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2022/02/15 5:15 p.m.15 views

CVE-2022-25178

Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier does not restrict the names of resources passed to the libraryResource step, allowing attackers able to configure Pipelines permission to read arbitrary files on the Jenkins controller file system...

6.5CVSS6.7AI score0.01668EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2022/02/09 4:15 p.m.15 views

CVE-2021-46152

A vulnerability has been identified in Simcenter Femap V2020.2 All versions, Simcenter Femap V2021.1 All versions. Affected application contains a type confusion vulnerability while parsing NEU files. This could allow an attacker to execute code in the context of the current process. ZDI-CAN-1464...

7.8CVSS7.3AI score0.01596EPSS
SaveExploits0References6
ATTACKERKB
ATTACKERKB
added 2022/02/08 3:15 p.m.15 views

CVE-2022-0510

Cross-site Scripting XSS - Reflected in Packagist pimcore/pimcore prior to 10.3.1...

5.4CVSS5.5AI score0.00619EPSS
SaveExploits1References3
ATTACKERKB
ATTACKERKB
added 2022/02/05 10:0 a.m.15 views

CVE-2021-4198

A NULL Pointer Dereference vulnerability in the messagingipc.dll component as used in Bitdefender Total Security, Internet Security, Antivirus Plus, Endpoint Security Tools, VPN Standalone allows an attacker to arbitrarily crash product processes and generate crashdump files. This issue affects:...

6.1CVSS6.3AI score0.00566EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2022/02/04 2:15 a.m.15 views

CVE-2021-46229

D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function usbpaswd.asp. This vulnerability allows attackers to execute arbitrary commands via the name parameter...

9.8CVSS8.2AI score0.04375EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2022/01/30 2:15 p.m.15 views

CVE-2022-0273

Improper Access Control in Pypi calibreweb prior to 0.6.16...

6.5CVSS5.6AI score0.0067EPSS
SaveExploits1References3
ATTACKERKB
ATTACKERKB
added 2022/01/27 1:15 p.m.15 views

CVE-2022-23181

The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is...

7CVSS6.8AI score0.56636EPSS
SaveExploits16References7Affected Software1
ATTACKERKB
ATTACKERKB
added 2022/01/25 1:15 a.m.15 views

CVE-2021-46482

Jsish v3.5.0 was discovered to contain a heap buffer overflow via NumberConstructor at src/jsiNumber.c...

7.8CVSS7.5AI score0.0084EPSS
SaveExploits1References2
ATTACKERKB
ATTACKERKB
added 2022/01/12 5:0 p.m.15 views

CVE-2022-22176

An Improper Validation of Syntactic Correctness of Input vulnerability in the Juniper DHCP daemon jdhcpd of Juniper Networks Junos OS allows an adjacent unauthenticated attacker sending a malformed DHCP packet to cause a crash of jdhcpd and thereby a Denial of Service DoS. If option-82 is...

7.4CVSS6.6AI score0.00368EPSS
SaveExploits0References2Affected Software1
ATTACKERKB
ATTACKERKB
added 2022/01/11 11:0 p.m.15 views

CVE-2022-22123

In Halo, versions v1.0.0 to v1.4.17 latest are vulnerable to Stored Cross-Site Scripting XSS in the article title. An authenticated attacker can inject arbitrary javascript code that will execute on a victim’s server...

5.4CVSS6.3AI score0.00708EPSS
SaveExploits1References4Affected Software1
ATTACKERKB
ATTACKERKB
added 2022/01/07 5:54 a.m.15 views

CVE-2021-46147

An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. MassEditRegex allows CSRF...

8.8CVSS6.6AI score0.00528EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2021/12/27 11:15 p.m.15 views

CVE-2021-45905

OpenWrt 21.02.1 allows XSS via the Traffic Rules Name screen...

5.4CVSS5.4AI score0.00515EPSS
SaveExploits1References2
ATTACKERKB
ATTACKERKB
added 2021/03/10 10:15 p.m.15 views

CVE-2021-21334

In containerd an industry-standard container runtime before versions 1.3.10 and 1.4.4, containers launched through containerd's CRI implementation through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service that share the same image may receive incorrect...

6.3CVSS5.3AI score0.02027EPSS
SaveExploits0References12Affected Software1
ATTACKERKB
ATTACKERKB
added 2020/09/25 12:0 a.m.15 views

CVE-2020-25223

A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11 Recent assessments: wvu-r7 at November 02, 2021 7:12pm UTC reported: See the other topic. Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

10CVSS7.7AI score0.96693EPSS
SaveExploits9References6
ATTACKERKB
ATTACKERKB
added 2020/08/05 7:15 p.m.15 views

CVE-2020-15106

In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of a record is stored in the length field of a WAL file and no additional validation is done on this data. Therefore, it is possible to forge an extremely large frame size that can unintentional...

6.5CVSS5.5AI score0.01291EPSS
SaveExploits0References4Affected Software1
ATTACKERKB
ATTACKERKB
added 2020/03/03 12:0 a.m.15 views

Task Scheduler S4U Logon Elevation of Privilege

The windows task scheduler allows a split token administrator to register a task which runs as a batch job from a limited privilege context. This doesn’t require a user’s password to accomplish as the task will be run non-interactively and so doesn’t need access to the password in order to access...

2.7AI score
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2020/02/13 12:0 a.m.15 views

Dell Foundation Services installs root certificate and private key (eDellRoot)

Dell Foundation Services installs the eDellRoot certificate into theTrusted Root Certificate Store on Microsoft Windows systems. The certificate includes the private key. This allows attackers to create trusted certificates and perform impersonation, man-in-the-middle MiTM, and passive decryption...

2.2AI score
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2019/10/06 12:0 a.m.15 views

CVE-2019-17240

bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Client-IP HTTP headers. Recent assessments: noraj at May 08, 2021 7:26pm UTC reported: This is just a security bypass allowing an attacker t...

9.8CVSS2.4AI score0.39598EPSS
SaveExploits9References7
ATTACKERKB
ATTACKERKB
added 2019/06/19 12:0 a.m.15 views

CVE-2019-19908

phpMyChat-Plus 1.98 is vulnerable to reflected XSS via JavaScript injection into the password reset URL. In the URL, the pmcusername parameter to passreset.php is vulnerable. Recent assessments: cinzinga at March 09, 2020 9:23pm UTC reported: I am the founder of this exploit. Google dorking...

6.1CVSS1AI score0.21232EPSS
SaveExploits4References4
ATTACKERKB
ATTACKERKB
added 2019/03/28 12:0 a.m.15 views

CVE-2019-17621

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network. Recent...

10CVSS7.2AI score0.89624EPSS
SaveExploits8References10
ATTACKERKB
ATTACKERKB
added 2018/09/13 12:29 a.m.15 views

CVE-2018-8447

A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. This CVE ID is unique from CVE-2018-8461...

7.6CVSS6.4AI score0.12895EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2018/08/13 12:0 a.m.15 views

CVE-2018-15142

Directory traversal in portal/importtemplate.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patient portal to execute arbitrary PHP code by writing a file with a PHP extension via the “docid” and “content” parameters and accessing it in the traversed...

8.8CVSS5.5AI score0.18208EPSS
SaveExploits6References6
ATTACKERKB
ATTACKERKB
added 2018/07/31 12:0 a.m.15 views

CVE-2018-14581

Redgate .NET Reflector before 10.0.7.774 and SmartAssembly before 6.12.5 allow attackers to execute code by decompiling a compiled .NET object such as a DLL or EXE file with a specific embedded resource file. Recent assessments: zeroSteiner at March 20, 2020 12:43pm UTC reported: A crafted .RESX...

7.8CVSS2.9AI score0.01838EPSS
SaveExploits1References4
ATTACKERKB
ATTACKERKB
added 2018/03/27 3:29 a.m.15 views

CVE-2018-9046

In Windows Master aka Windows Optimization Master 7.99.13.604, the driver file WoptiHWDetect.SYS allows local users to cause a denial of service BSOD or possibly have unspecified other impact because of not validating input values from IOCtl 0xf100282d...

7.8CVSS5.8AI score0.00406EPSS
SaveExploits1References2
ATTACKERKB
ATTACKERKB
added 2014/09/30 10:55 a.m.15 views

CVE-2014-6278

GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the modcgi and...

10CVSS7.3AI score0.99621EPSS
SaveExploits33References137
ATTACKERKB
ATTACKERKB
added 2014/02/05 12:0 a.m.15 views

CVE-2014-0497

Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors. Recent assessments: Assessed Attacker Value: 0 Assessed...

10CVSS8.2AI score0.99883EPSS
SaveExploits7References17
ATTACKERKB
ATTACKERKB
added 2011/08/18 11:55 p.m.15 views

CVE-2011-2955

Use-after-free vulnerability in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.0 through 2.1.5, when an Embedded RealPlayer is used, allows remote attackers to execute arbitrary code via vectors related to a modal...

9.3CVSS6.2AI score0.03682EPSS
SaveExploits0References4
Total number of security vulnerabilities5000