Lucene search
+L
CvelistMost viewed

398560 matches found

Cvelist
Cvelist
•added 2024/12/22 12:00 a.m.•88 views

CVE-2024-56378

libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc...

0.00638EPSS
SaveExploits1References3
Cvelist
Cvelist
•added 2024/12/12 7:20 p.m.•88 views

CVE-2024-55878 Cross-site Scripting vulnerability in SimpleXLSXEx::readXfs and SimpeXLSX::toHTMLEx

SimpleXLSX is software for parsing and retrieving data from Excel XLSx files. Starting in version 1.0.12 and prior to version 1.1.12, when calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code. Version 1.1.12 fixes the issue. As a workaround, don't use direct...

6.8CVSS0.00459EPSS
SaveExploits0References2
Cvelist
Cvelist
•added 2024/11/26 8:00 p.m.•88 views

CVE-2024-11742 SourceCodester Best House Rental Management System ajax.php cross site scripting

A vulnerability, which was classified as problematic, has been found in SourceCodester Best House Rental Management System 1.0. This issue affects some unknown processing of the file /rental/ajax.php?action=savetenant. The manipulation of the argument lastname/firstname/middlename leads to cross...

5.3CVSS0.0053EPSS
SaveExploits1References5
Cvelist
Cvelist
•added 2024/11/21 6:17 p.m.•88 views

CVE-2024-53094 RDMA/siw: Add sendpage_ok() check to disable MSG_SPLICE_PAGES

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Add sendpageok check to disable MSGSPLICEPAGES While running ISER over SIW, the initiator machine encounters a warning from skbsplicefromiter indicating that a slab page is being used in sendpage. To address this, it is...

9.8CVSS0.00588EPSS
SaveExploits0References3
Cvelist
Cvelist
•added 2024/11/12 5:54 p.m.•88 views

CVE-2024-49021 Microsoft SQL Server Remote Code Execution Vulnerability

...

7.8CVSS0.00769EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2024/11/11 7:17 p.m.•88 views

CVE-2024-51992 Method Exposure Vulnerability in Modals in orchid/platform

Orchid is a @laravel package that allows for rapid application development of back-office applications, admin/user panels, and dashboards. This vulnerability is a method exposure issue CWE-749: Exposed Dangerous Method or Function in the Orchid Platform’s asynchronous modal functionality, affecti...

4.1CVSS0.00331EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2024/09/01 12:00 a.m.•88 views

CVE-2024-45509

In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the user is not an org admin...

0.00398EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2024/08/05 8:20 a.m.•88 views

CVE-2024-38856 Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code

Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met...

0.99427EPSS
SaveExploits11References4
Cvelist
Cvelist
•added 2024/07/09 5:03 p.m.•88 views

CVE-2024-38058 BitLocker Security Feature Bypass Vulnerability

...

6.8CVSS0.00929EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2024/07/01 6:10 p.m.•88 views

CVE-2024-36387 Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2

Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance...

0.01715EPSS
SaveExploits0References2
Cvelist
Cvelist
•added 2024/06/25 3:04 p.m.•88 views

CVE-2024-5806 MOVEit Transfer Authentication Bypass Vulnerability

Improper Authentication vulnerability in Progress MOVEit Transfer SFTP module can lead to Authentication Bypass.This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.11, from 2023.1.0 before 2023.1.6, from 2024.0.0 before 2024.0.2...

9.1CVSS0.81474EPSS
SaveExploits3References2
Cvelist
Cvelist
•added 2024/06/17 7:25 p.m.•88 views

CVE-2024-37902 Path thraversal in DeepJavaLibrary

DeepJavaLibraryDJL is an Engine-Agnostic Deep Learning Framework in Java. DJL versions 0.1.0 through 0.27.0 do not prevent absolute path archived artifacts from inserting archived files directly into the system, overwriting system files. This is fixed in DJL 0.28.0 and patched in DJL Large Model...

10CVSS0.00784EPSS
SaveExploits0References2
Cvelist
Cvelist
•added 2024/05/21 3:30 p.m.•88 views

CVE-2023-52760 gfs2: Fix slab-use-after-free in gfs2_qd_dealloc

In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix slab-use-after-free in gfs2qddealloc In gfs2putsuper, whether withdrawn or not, the quota should be cleaned up by gfs2quotacleanup. Otherwise, struct gfs2sbd will be freed before gfs2qddealloc rcu callback has run for a...

7.8CVSS7.5AI score0.00269EPSS
SaveExploits0References2
Cvelist
Cvelist
•added 2024/05/11 5:38 a.m.•88 views

CVE-2024-4560 Kognetiks Chatbot for WordPress <= 1.9.9 - Unauthenticated Arbitrary File Upload via chatbot_chatgpt_upload_file_to_assistant Function

The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the chatbotchatgptuploadfiletoassistant function in all versions up to, and including, 1.9.9. This makes it possible for unauthenticated attackers, with to uploa...

9.8CVSS10AI score0.00905EPSS
SaveExploits0References2
Cvelist
Cvelist
•added 2024/05/09 9:51 p.m.•88 views

CVE-2024-0087 CVE

NVIDIA Triton Inference Server for Linux contains a vulnerability where a user can set the logging location to an arbitrary file. If this file exists, logs are appended to the file. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privilege...

9CVSS9.4AI score0.1992EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2024/05/03 2:15 a.m.•88 views

CVE-2023-51618 D-Link DIR-X3260 prog.cgi SetWLanRadioSecurity Stack-Based Buffer Overflow Remote Code Execution Vulnerability

D-Link DIR-X3260 prog.cgi SetWLanRadioSecurity Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Authentication is required to exploit this...

6.8CVSS7.3AI score0.01126EPSS
SaveExploits0References2
Cvelist
Cvelist
•added 2024/04/29 3:34 a.m.•88 views

CVE-2024-2756 __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix

Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a Host- or Secure- cookie by PHP applications...

6.5CVSS7.5AI score0.38115EPSS
SaveExploits0References4
Cvelist
Cvelist
•added 2024/04/25 11:02 a.m.•88 views

CVE-2024-2829 Inefficient Regular Expression Complexity in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.5 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. A crafted wildcard filter in FileFinder may lead to a denial of service...

7.5CVSS7.4AI score0.25965EPSS
SaveExploits0References2
Cvelist
Cvelist
•added 2024/04/08 1:51 p.m.•88 views

CVE-2024-2511 Unbounded memory growth with session handling in TLSv1.3

Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in...

9.4AI score0.52421EPSS
SaveExploits0References5
Cvelist
Cvelist
•added 2024/03/29 12:00 a.m.•88 views

CVE-2024-28960

An issue was discovered in Mbed TLS 2.18.0 through 2.28.x before 2.28.8 and 3.x before 3.6.0, and Mbed Crypto. The PSA Crypto API mishandles shared memory...

7.6AI score0.00847EPSS
SaveExploits0References5
Cvelist
Cvelist
•added 2024/02/13 6:02 p.m.•88 views

CVE-2024-21410 Microsoft Exchange Server Elevation of Privilege Vulnerability

...

9.8CVSS9.7AI score0.12561EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2024/01/16 3:56 p.m.•88 views

CVE-2023-1405 Formidable Forms < 6.2 - Unauthenticated PHP Object Injection

The Formidable Forms WordPress plugin before 6.2 unserializes user input, which could allow anonymous users to perform PHP Object Injection when a suitable gadget is present...

7.9AI score0.00702EPSS
SaveExploits2References1
Cvelist
Cvelist
•added 2023/09/13 1:19 p.m.•88 views

CVE-2023-3935 Wibu: Buffer Overflow in CodeMeter Runtime

A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system...

9.8CVSS10AI score0.01971EPSS
SaveExploits0References3
Cvelist
Cvelist
•added 2022/11/22 12:00 a.m.•88 views

CVE-2022-38724

Silverstripe silverstripe/framework through 4.11.0, silverstripe/assets through 1.11.0, and silverstripe/asset-admin through 1.11.0 allow XSS...

5.8AI score0.00684EPSS
SaveExploits1References4
Cvelist
Cvelist
•added 2022/05/10 8:35 p.m.•88 views

CVE-2022-30130 .NET Framework Denial of Service Vulnerability

...

3.3CVSS4.5AI score0.02909EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2021/11/15 12:00 a.m.•88 views

CVE-2021-42375

An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input...

7.4AI score0.00409EPSS
SaveExploits0References5
Cvelist
Cvelist
•added 2021/06/22 6:10 p.m.•88 views

CVE-2021-22377

There is a command injection vulnerability in S12700 V200R019C00SPC500, S2700 V200R019C00SPC500, S5700 V200R019C00SPC500, S6700 V200R019C00SPC500 and S7700 V200R019C00SPC500. A module does not verify specific input sufficiently. Attackers can exploit this vulnerability by sending malicious...

7.3AI score0.00917EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2021/06/07 8:27 p.m.•88 views

CVE-2020-25716

A flaw was found in Cloudforms. A role-based privileges escalation flaw where export or import of administrator files is possible. An attacker with a specific group can perform actions restricted only to system administrator. This is the affect of an incomplete fix for CVE-2020-10783. The highest...

8.1AI score0.00769EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2020/10/12 1:46 p.m.•88 views

CVE-2020-13943

If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection in violation of the HTTP/2 protocol, it was possible that a subsequent request made on that connection could...

4.8AI score0.57286EPSS
SaveExploits0References7
Cvelist
Cvelist
•added 2020/06/06 3:37 p.m.•88 views

CVE-2020-13871

SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late...

7.5AI score0.04447EPSS
SaveExploits1References10
Cvelist
Cvelist
•added 2020/01/14 4:46 p.m.•88 views

CVE-2015-2325

The compilebranch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service out-of-bounds heap read and crash, or possibly have other unspecified impact via a regular expression with a group containing a forward reference repeated a large...

8AI score0.01575EPSS
SaveExploits1References4
Cvelist
Cvelist
•added 2019/05/22 7:34 p.m.•88 views

CVE-2018-7828

A Cross-Site Request Forgery CSRF vulnerability exists in the 1st Gen. Pelco Sarix Enhanced Camera and Spectra Enhanced PTZ Camera when an authenticated user clicks a specially crafted malicious link while logged into the camera...

8.2AI score0.00572EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2018/07/18 11:00 p.m.•88 views

CVE-2018-0374

A vulnerability in the Policy Builder database of Cisco Policy Suite before 18.2.0 could allow an unauthenticated, remote attacker to connect directly to the Policy Builder database. The vulnerability is due to a lack of authentication. An attacker could exploit this vulnerability by connecting...

9.4AI score0.02621EPSS
SaveExploits0References2
Cvelist
Cvelist
•added 2016/12/13 4:00 p.m.•88 views

CVE-2016-7440

The C software implementation of AES Encryption and Decryption in wolfSSL formerly CyaSSL before 3.9.10 makes it easier for local users to discover AES keys by leveraging cache-bank timing differences...

5.5AI score0.00304EPSS
SaveExploits0References6
Cvelist
Cvelist
•added 2014/02/06 2:00 a.m.•88 views

CVE-2013-4463

OpenStack Compute Nova Folsom, Grizzly, and Havana does not properly verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service host file system disk consumption via a compressed QCOW2 image. NOTE: this issue is due to an incomplete fix for CVE-2013-2096...

5.8AI score0.00372EPSS
SaveExploits0References4
Cvelist
Cvelist
•added 2013/10/21 5:00 p.m.•88 views

CVE-2013-4450

The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service memory and CPU consumption by sending a large number of pipelined requests without reading the response...

6.2AI score0.3722EPSS
SaveExploits3References10
Cvelist
Cvelist
•added 2011/11/08 11:00 a.m.•88 views

CVE-2011-3607

Integer overflow in the appregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the modsetenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted...

7.8AI score0.04719EPSS
SaveExploits5References48
Cvelist
Cvelist
•added 2011/09/30 5:00 p.m.•88 views

CVE-2011-3580

IceWarp WebMail in IceWarp Mail Server before 10.3.3 allows remote attackers to obtain configuration information via a direct request to the /server URI, which triggers a call to the phpinfo function...

6.2AI score0.0161EPSS
SaveExploits2References7
Cvelist
Cvelist
•added 2026/09/16 8:07 p.m.•87 views

CVE-2026-20192 Cisco Identity Services Engine Hardening Release - Access Control Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release...

10CVSS0.00458EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/15 6:34 p.m.•87 views

CVE-2026-58704

In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote proximal/adjacent escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

0.00591EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/08/19 5:24 p.m.•87 views

CVE-2026-32475 WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1...

9CVSS0.01711EPSS
SaveExploits5References2
Cvelist
Cvelist
•added 2026/08/11 5:04 p.m.•87 views

CVE-2026-62815 Microsoft QUIC Remote Code Execution Vulnerability

...

9.8CVSS0.00974EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/08/06 2:27 p.m.•87 views

CVE-2026-28177 WordPress Popup Maker plugin <= 1.23.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Popup Maker = 1.23.0 versions...

7.1CVSS0.00251EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/08/03 2:56 a.m.•87 views

CVE-2026-13506 Lazy ASN.1 sequence forcing resets nesting-depth guard

In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

8.7CVSS0.00442EPSS
SaveExploits0References2
Cvelist
Cvelist
•added 2026/07/29 5:58 p.m.•87 views

CVE-2026-59900 Netty codec-http2: Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer Http2StreamFrameToHttpObjectCodec and InboundHttp2ToHttpAdapter fails to deduplicate or validate Host headers when an HTTP/2 client...

6.9CVSS0.00398EPSS
SaveExploits0References3
Cvelist
Cvelist
•added 2026/07/29 3:29 p.m.•87 views

CVE-2026-16543 Kong Operator cluster-wide ingress configuration DoS via embedded KIC CA-certificate ID collision

Kong Operator's embedded Kong Kubernetes Ingress Controller KIC allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. The embedded KIC collects CA-certificate Secrets across all watched namespaces using a label selector...

7.1CVSS0.00228EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/07/21 11:15 p.m.•87 views

CVE-2026-16488 QUSETIONS MiniCode-Python Project File config.py subprocess.Popen os command injection

A vulnerability was determined in QUSETIONS MiniCode-Python 0.1.0. This vulnerability affects the function subprocess.Popen of the file minicode/config.py of the component Project File Handler. Executing a manipulation can lead to os command injection. The attack may be launched remotely. A high...

5.1CVSS0.01486EPSS
SaveExploits0References10
Cvelist
Cvelist
•added 2026/07/14 7:29 p.m.•87 views

CVE-2026-50648 .NET Framework Denial of Service Vulnerability

...

7.5CVSS0.01174EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/07/09 6:36 p.m.•87 views

CVE-2026-54003 Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header

Kirby is an open-source content management system. Prior to 4.9.4 and from 5.4.4, Kirby sites with no configured user accounts that run on publicly accessible servers behind a reverse proxy setting the Forwarded, X-Client-IP, or X-Real-IP request header could allow remote attackers to install the...

9.1CVSS0.00743EPSS
SaveExploits0References8
Cvelist
Cvelist
•added 2026/07/08 2:32 p.m.•87 views

CVE-2026-15062 SQL Injection in Snowflake Snowpark Python SDK

SQL injection vulnerabilities in the Snowflake Snowpark Python SDK snowpark-python versions prior to 1.53.0 could allow authenticated low-privilege users to execute SQL beyond their authorization scope. An attacker could exploit these vulnerabilities by embedding SQL payloads in source database...

9.6CVSS0.00386EPSS
SaveExploits0References1
Total number of security vulnerabilities5000