Lucene search
+L
NvdMost viewed

379084 matches found

NVD
NVD
•added 2024/07/10 8:15 p.m.•69 views

CVE-2024-39693

Next.js is a React framework. A Denial of Service DoS condition was identified in Next.js. Exploitation of the bug can trigger a crash, affecting the availability of the server. his vulnerability was resolved in Next.js 13.5 and later...

7.5CVSS0.0049EPSS
SaveExploits0References1
NVD
NVD
•added 2024/01/29 8:15 p.m.•69 views

CVE-2023-51839

DeviceFarmer stf v3.6.6 suffers from Use of a Broken or Risky Cryptographic Algorithm...

9.1CVSS9.3AI score0.00376EPSS
SaveExploits0References3
NVD
NVD
•added 2023/12/01 10:15 p.m.•69 views

CVE-2023-49281

Calendarinho is an open source calendaring application to manage large teams of consultants. An Open Redirect issue occurs when a web application redirects users to external URLs without proper validation. This can lead to phishing attacks, where users are tricked into visiting malicious sites,...

6.1CVSS0.00557EPSS
SaveExploits0References4
NVD
NVD
•added 2023/10/03 5:15 a.m.•69 views

CVE-2023-26150

Versions of the package asyncua before 0.9.96 are vulnerable to Improper Authentication such that it is possible to access Address Space without encryption and authentication. Note: This issue is a result of missing checks for services that require an active session...

7.5CVSS6.8AI score0.00458EPSS
SaveExploits1References7
NVD
NVD
•added 2023/08/31 6:15 a.m.•69 views

CVE-2023-3162

The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.7.7. This is due to insufficient verification on the user being supplied during a Stripe checkout through the plugin. This allows unauthenticated attackers to...

9.8CVSS9.6AI score0.012EPSS
SaveExploits2References3
NVD
NVD
•added 2023/08/11 7:15 a.m.•69 views

CVE-2023-4105

Mattermost fails to delete the attachments when deleting a message in a thread allowing a simple user to still be able to access and download the attachment of a deleted message...

4.3CVSS4.2AI score0.00399EPSS
SaveExploits0References1
NVD
NVD
•added 2023/06/23 9:15 p.m.•69 views

CVE-2023-35169

PHP-IMAP is a wrapper for common IMAP communication without the need to have the php-imap module installed / enabled. Prior to version 5.3.0, an unsanitized attachment filename allows any unauthenticated user to leverage a directory traversal vulnerability, which results in a remote code executio...

9.8CVSS9.7AI score0.03191EPSS
SaveExploits1References5
NVD
NVD
•added 2023/06/05 6:15 a.m.•69 views

CVE-2023-3096

A vulnerability was found in KylinSoft kylin-software-properties on KylinOS. It has been declared as critical. This vulnerability affects the function changedSource. The manipulation leads to improper access controls. An attack has to be approached locally. The exploit has been disclosed to the...

7.8CVSS6AI score0.00332EPSS
SaveExploits1References3
NVD
NVD
•added 2023/05/29 12:15 a.m.•69 views

CVE-2023-30350

FS S3900-24T4S devices allow authenticated attackers with guest access to escalate their privileges and reset the admin password...

8.8CVSS8.8AI score0.05343EPSS
SaveExploits4References1
NVD
NVD
•added 2023/05/11 10:15 p.m.•69 views

CVE-2023-32059

Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, internal calls with default arguments are compiled incorrectly. Depending on the number of arguments provided in the call, the defaults are added not right-to-left, but left-to-right. If the type...

7.5CVSS7.4AI score0.00725EPSS
SaveExploits1References2
NVD
NVD
•added 2023/05/09 10:15 p.m.•69 views

CVE-2023-28128

An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove code execution...

7.2CVSS7.1AI score0.84697EPSS
SaveExploits3References3
NVD
NVD
•added 2023/01/27 7:15 p.m.•69 views

CVE-2021-41231

OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, an administrator with the permissions to upload files via DataFlow and to create products was able to execute arbitrary code via the convert profile. Versions 19.4.22 and 20.0.19 contain a patch for this issue...

7.2CVSS7.3AI score0.01235EPSS
SaveExploits0References4
NVD
NVD
•added 2023/01/26 9:18 p.m.•69 views

CVE-2023-24443

Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

9.8CVSS9.5AI score0.01215EPSS
SaveExploits0References1
NVD
NVD
•added 2022/12/13 4:15 p.m.•69 views

CVE-2022-20486

In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

7.8CVSS0.0012EPSS
SaveExploits0References1
NVD
NVD
•added 2022/10/11 11:15 a.m.•69 views

CVE-2022-38371

A vulnerability has been identified in APOGEE MBC PPC BACnet All versions, APOGEE MBC PPC P2 Ethernet All versions, APOGEE MEC PPC BACnet All versions, APOGEE MEC PPC P2 Ethernet All versions, APOGEE PXC Compact BACnet All versions = V2.3 = V2.3 = V2.3 = V2.3 = V2.3 = V2.3 = V2.3 = V2.3 = V2.3 =...

8.7CVSS0.01345EPSS
SaveExploits0References4
NVD
NVD
•added 2022/08/15 11:21 a.m.•69 views

CVE-2022-36007

Venice is a Clojure inspired sandboxed Lisp dialect with excellent Java interoperability. A partial path traversal issue exists within the functions load-file and load-resource. These functions can be limited to load files from a list of load paths. Assuming Venice has been configured with the lo...

6.1CVSS0.0043EPSS
SaveExploits1References4
NVD
NVD
•added 2022/07/22 4:15 p.m.•69 views

CVE-2022-2511

Cross-site Scripting XSS vulnerability in the "commonuserinterface" component of BlueSpice allows an attacker to inject arbitrary HTML into a page using the title parameter of the call URL...

6.1CVSS0.00443EPSS
SaveExploits0References1
NVD
NVD
•added 2021/11/19 4:15 p.m.•69 views

CVE-2021-22053

Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at /hystrix/monitor;user-provided data, the path elements following...

8.8CVSS0.13035EPSS
SaveExploits0References1
NVD
NVD
•added 2021/06/22 7:15 p.m.•69 views

CVE-2021-22377

There is a command injection vulnerability in S12700 V200R019C00SPC500, S2700 V200R019C00SPC500, S5700 V200R019C00SPC500, S6700 V200R019C00SPC500 and S7700 V200R019C00SPC500. A module does not verify specific input sufficiently. Attackers can exploit this vulnerability by sending malicious...

7.2CVSS0.00917EPSS
SaveExploits0References1
NVD
NVD
•added 2021/05/24 6:15 p.m.•69 views

CVE-2020-20907

MetInfo 7.0 beta is affected by a file modification vulnerability. Attackers can delete and modify ini files in app/system/language/admin/languagegeneral.class.php and app/system/include/function/file.func.php...

9.1CVSS0.02201EPSS
SaveExploits1References3
NVD
NVD
•added 2021/03/25 9:15 a.m.•69 views

CVE-2021-26715

The OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Server Side Request Forgery SSRF vulnerability. The vulnerability arises due to unsafe usage of the logouri parameter in the Dynamic Client Registration request. An unauthenticated attacker can make a HTTP reque...

9.1CVSS0.01494EPSS
SaveExploits1References2
NVD
NVD
•added 2021/02/26 5:15 p.m.•69 views

CVE-2021-21298

Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier has a vulnerability which allows arbitrary path traversal via the Projects API. If the Projects feature is enabled, a user with projects.read permission is able to access any file via t...

6.5CVSS0.01177EPSS
SaveExploits0References4
NVD
NVD
•added 2021/02/08 11:15 p.m.•69 views

CVE-2021-26917

PyBitmessage through 0.6.3.2 allows attackers to write screen captures to Potentially Unwanted Directories via a crafted apinotifypath value. NOTE: the discoverer states "security mitigation may not be necessary as there is no evidence yet that these screen intercepts are actually transported awa...

5.5CVSS0.0055EPSS
SaveExploits1References4
NVD
NVD
•added 2020/12/02 8:15 a.m.•69 views

CVE-2020-29456

Multiple cross-site scripting XSS vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the rename, tag, upload, or create folder function. The payload can be in a folder, a tag, or a document's filename. If email consumption is configured in...

6.1CVSS6.1AI score0.0154EPSS
SaveExploits0References3
NVD
NVD
•added 2020/08/14 5:15 p.m.•69 views

CVE-2020-15141

In openapi-python-client before version 0.5.3, there is a path traversal vulnerability. If a user generated a client using a maliciously crafted OpenAPI document, it is possible for generated files to be placed in arbitrary locations on disk...

4.1CVSS4AI score0.01137EPSS
SaveExploits0References4
NVD
NVD
•added 2020/02/17 8:15 p.m.•69 views

CVE-2019-19325

SilverStripe through 4.4.x before 4.4.5 and 4.5.x before 4.5.2 allows Reflected XSS on the login form and custom forms. Silverstripe Forms allow malicious HTML or JavaScript to be inserted through non-scalar FormField attributes, which allows performing XSS Cross-Site Scripting on some forms buil...

6.1CVSS6AI score0.00685EPSS
SaveExploits0References1
NVD
NVD
•added 2019/08/26 12:15 p.m.•69 views

CVE-2016-10931

An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off by default and there is no API for hostname verification...

8.1CVSS8AI score0.00745EPSS
SaveExploits0References1
NVD
NVD
•added 2006/05/19 11:2 p.m.•69 views

CVE-2006-2483

PHP remote file inclusion vulnerability in cartcontent.php in Squirrelcart 2.2.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cartisproot parameter...

6.4CVSS7.6AI score0.07538EPSS
SaveExploits2References7
NVD
NVD
•added 2026/05/13 10:16 p.m.•68 views

CVE-2026-32993

Improper sanitization of the status query parameter of the /unprotected/novaerror endpoint allows unauthenticated attacker to inject arbitrary HTTP header to the response...

8.3CVSS0.00301EPSS
SaveExploits0References1
NVD
NVD
•added 2026/05/08 8:16 p.m.•68 views

CVE-2026-42189

Russh is a Rust SSH client & server library. Prior to version 0.60.1, a pre-authentication denial-of-service vulnerability exists in the server's keyboard-interactive authentication handler. A malicious client can crash any russh-based server that implements keyboard-interactive auth e.g., for...

7.5CVSS0.00481EPSS
SaveExploits1References3
NVD
NVD
•added 2026/05/07 10:16 p.m.•68 views

CVE-2026-35428

Improper neutralization of special elements used in a command 'command injection' in Azure Cloud Shell allows an unauthorized attacker to perform spoofing over a network...

9.6CVSS0.00933EPSS
SaveExploits0References1
NVD
NVD
•added 2026/04/23 1:16 p.m.•68 views

CVE-2026-39440

Improper Control of Generation of Code 'Code Injection' vulnerability in Funnelforms LLC FunnelFormsPro allows Remote Code Inclusion.This issue affects FunnelFormsPro: from n/a through 3.8.1...

9.9CVSS0.00364EPSS
SaveExploits1References1
NVD
NVD
•added 2026/03/30 7:16 p.m.•68 views

CVE-2026-34714

Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %expr injection occurs with tabpanel lacking PMLE...

9.2CVSS0.00588EPSS
SaveExploits0References10
NVD
NVD
•added 2026/01/21 6:16 p.m.•68 views

CVE-2021-47869

Brother BRAdmin Professional 3.75 contains an unquoted service path vulnerability in the BRAScheduler service that allows local users to potentially execute arbitrary code. Attackers can place a malicious executable named 'BRAdmin' in the C:\Program Files x86\Brother\ directory to gain local syst...

8.5CVSS0.00129EPSS
SaveExploits0References5
NVD
NVD
•added 2026/01/06 4:15 p.m.•68 views

CVE-2020-36915

Adtec Digital SignEdje Digital Signage Player v2.08.28 contains multiple hardcoded default credentials that allow unauthenticated remote access to web, telnet, and SSH interfaces. Attackers can exploit these credentials to gain root-level access and execute system commands across multiple Adtec...

8.7CVSS0.00336EPSS
SaveExploits1References6
NVD
NVD
•added 2025/09/09 11:15 p.m.•68 views

CVE-2025-59039

Prebid Universal Creative PUC is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware. This includes the extremely popular jsdelivr hosting of this file. The maintainers of PUC unpublished version 1.17.3. Users should s...

9.3CVSS0.00334EPSS
SaveExploits0References2
NVD
NVD
•added 2025/08/13 6:15 p.m.•68 views

CVE-2025-23298

NVIDIA Merlin Transformers4Rec for all platforms contains a vulnerability in a python dependency, where an attacker could cause a code injection issue. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering...

7.8CVSS0.00729EPSS
SaveExploits0References3
NVD
NVD
•added 2025/06/03 3:15 p.m.•68 views

CVE-2025-46548

If you enable Basic Authentication in Pekko Management using the Java DSL, the authenticator may not be properly applied. Users that rely on authentication instead of making sure the Management API ports are only available to trusted users are recommended to upgrade to version 1.1.1, which fixes...

6.5CVSS0.00682EPSS
SaveExploits1References4
NVD
NVD
•added 2025/04/20 1:15 a.m.•68 views

CVE-2025-43921

GNU Mailman 2.1.39, as bundled in cPanel and WHM, allows unauthenticated attackers to create lists via the /mailman/create endpoint. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used...

5.3CVSS0.00432EPSS
SaveExploits1References4
NVD
NVD
•added 2025/04/18 6:15 p.m.•68 views

CVE-2025-29512

Cross-Site Scripting XSS vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code and potentially render the blacklist IP functionality unusable until content is removed via the database...

6.1CVSS0.00272EPSS
SaveExploits0References1
NVD
NVD
•added 2024/12/27 10:15 a.m.•68 views

CVE-2024-3393

A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall t...

8.7CVSS0.28617EPSS
SaveExploits0References2
NVD
NVD
•added 2024/12/12 9:15 a.m.•68 views

CVE-2024-4109

Rejected reason: Red Hat Product Security has determined that this CVE is not a security vulnerability...

SaveExploits0
NVD
NVD
•added 2024/12/06 3:15 p.m.•68 views

CVE-2024-54141

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Prior to 4.0.0, phpMyFAQ exposes the database ie postgreSQL server's credential when connection to DB fails. This vulnerability is fixed in 4.0.0...

8.6CVSS0.00487EPSS
SaveExploits1References2
NVD
NVD
•added 2024/12/05 3:15 p.m.•68 views

CVE-2024-11942

A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10...

5.9CVSS0.00375EPSS
SaveExploits0References1
NVD
NVD
•added 2024/12/03 5:15 p.m.•68 views

CVE-2024-25019

IBM Cognos Controller 11.0.0 and 11.0.1 could be vulnerable to malicious file upload by not validating the type of file uploaded to Journal entry attachments. Attackers can make use of this weakness and upload malicious executable files into the system that can be sent to victims for performing...

9.8CVSS0.00275EPSS
SaveExploits0References1
NVD
NVD
•added 2024/12/02 6:15 p.m.•68 views

CVE-2024-53990

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When making any HTTP request, the automatically enabled and self-managed CookieStore aka cookie jar will silently replace explicitly defined Cookies with any that ha...

9.2CVSS0.00587EPSS
SaveExploits0References4
NVD
NVD
•added 2024/11/21 5:15 p.m.•68 views

CVE-2024-52803

LLama Factory enables fine-tuning of large language models. A critical remote OS command injection vulnerability has been identified in the LLama Factory training process. This vulnerability arises from improper handling of user input, allowing malicious actors to execute arbitrary OS commands on...

9.8CVSS0.02273EPSS
SaveExploits1References3
NVD
NVD
•added 2024/11/18 3:15 p.m.•68 views

CVE-2024-52431

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Pressaholic WordPress Video Robot - The Ultimate Video Importer allows SQL Injection.This issue affects WordPress Video Robot - The Ultimate Video Importer: from n/a through 1.20.0...

9.8CVSS0.00449EPSS
SaveExploits0References1
NVD
NVD
•added 2024/11/15 4:15 p.m.•68 views

CVE-2024-51497

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting XSS vulnerability in the "Custom OID" tab of a device allows authenticated users to inject arbitrary JavaScript through the "unit" parameter when creating a new OID. This vulnerability can le...

5.4CVSS0.00397EPSS
SaveExploits1References2
NVD
NVD
•added 2024/11/12 8:15 p.m.•68 views

CVE-2024-2208

Potential vulnerabilities have been identified in the audio package for certain HP PC products using the Sound Research SECOMN64 driver, which might allow escalation of privilege. Sound Research has released driver updates to mitigate the potential vulnerabilities...

8.8CVSS0.00167EPSS
SaveExploits0References1
Total number of security vulnerabilities5000