Lucene search
+L
NvdMost viewed

399545 matches found

NVD
NVD
•added 2024/07/15 8:15 p.m.•61 views

CVE-2024-39912

web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. The ProfileBasedRequestOptionsBuilder method returns allowedCredentials without any credentials if no username was found...

5.3CVSS0.00394EPSS
SaveExploits0References2
NVD
NVD
•added 2024/07/09 5:15 p.m.•61 views

CVE-2024-38100

Windows File Explorer Elevation of Privilege Vulnerability...

7.8CVSS0.04515EPSS
SaveExploits0References1
NVD
NVD
•added 2024/07/04 11:15 p.m.•61 views

CVE-2024-39943

rejetto HFS aka HTTP File Server 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users if they have Upload permissions. This occurs because a shell is used to execute df i.e., with execSync instead of spawnSync in childprocess in Node.js...

9.9CVSS0.39474EPSS
SaveExploits1References3
NVD
NVD
•added 2024/07/01 4:15 p.m.•61 views

CVE-2024-36422

Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the api/v1/chatflows/id endpoint. If the default configuration is used unauthenticated, an attacker may be able to craft a...

6.1CVSS0.00406EPSS
SaveExploits1References2
NVD
NVD
•added 2024/06/27 4:15 p.m.•61 views

CVE-2024-39374

TELSAT marKoni FM Transmitters are vulnerable to an attacker exploiting a hidden admin account that can be accessed through the use of hard-coded credentials...

9.8CVSS0.00524EPSS
SaveExploits1References1
NVD
NVD
•added 2024/06/14 6:15 a.m.•61 views

CVE-2023-51496

Missing Authorization vulnerability in Woo WooCommerce Warranty Requests.This issue affects WooCommerce Warranty Requests: from n/a through 2.2.7...

5.3CVSS0.00313EPSS
SaveExploits0References1
NVD
NVD
•added 2024/06/13 8:16 a.m.•61 views

CVE-2024-36226

Adobe Experience Manager versions 6.5.20 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and affect the integrity of the page. Exploitatio...

3.5CVSS0.00667EPSS
SaveExploits0References1
NVD
NVD
•added 2024/06/12 9:15 a.m.•61 views

CVE-2023-51537

Missing Authorization vulnerability in Awesome Support Team Awesome Support.This issue affects Awesome Support: from n/a through 6.1.5...

7.3CVSS0.00301EPSS
SaveExploits0References1
NVD
NVD
•added 2024/06/11 5:15 p.m.•61 views

CVE-2024-30064

Windows Kernel Elevation of Privilege Vulnerability...

8.8CVSS0.00791EPSS
SaveExploits0References1
NVD
NVD
•added 2024/06/09 1:15 p.m.•61 views

CVE-2024-32778

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery.This issue affects Contest Gallery: from n/a through = 21.3.4...

8.1CVSS0.00612EPSS
SaveExploits0References2
NVD
NVD
•added 2024/06/09 12:15 p.m.•61 views

CVE-2024-33565

Missing Authorization vulnerability in UkrSolution Barcode Scanner with Inventory & Order Manager.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through 1.5.3...

9.1CVSS0.00413EPSS
SaveExploits0References1
NVD
NVD
•added 2024/06/08 2:15 p.m.•61 views

CVE-2024-35708

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in apollo13themes Rife Free allows Stored XSS.This issue affects Rife Free: from n/a through 2.4.19...

6.5CVSS0.00261EPSS
SaveExploits0References1
NVD
NVD
•added 2024/06/07 12:15 p.m.•61 views

CVE-2024-4610

Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r34p0 through r40p0;...

7.8CVSS0.00758EPSS
SaveExploits0References2
NVD
NVD
•added 2024/05/17 9:15 a.m.•61 views

CVE-2024-30479

Authentication Bypass by Spoofing vulnerability in LionScripts IP Blocker Lite allows Functionality Bypass.This issue affects IP Blocker Lite: from n/a through 11.1.1...

5.3CVSS5.3AI score0.00536EPSS
SaveExploits0References1
NVD
NVD
•added 2024/05/03 5:15 p.m.•61 views

CVE-2024-30851

Directory Traversal vulnerability in codesiddhant Jasmin Ransomware v.1.0.1 allows an attacker to obtain sensitive information via the downloadfile.php component...

6.5CVSS5.9AI score0.04611EPSS
SaveExploits6References2
NVD
NVD
•added 2024/04/12 8:15 p.m.•61 views

CVE-2024-32000

matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. matrix-appservice-irc before version 2.0.0 can be exploited to leak the truncated body of a message if a malicious user sends a Matrix reply to an event ID they don't have access to. As a precondition to the attack,...

4.3CVSS4.4AI score0.00454EPSS
SaveExploits0References3
NVD
NVD
•added 2024/03/28 2:15 p.m.•61 views

CVE-2024-28109

veraPDF-library is a PDF/A validation library. Executing policy checks using custom schematron files invokes an XSL transformation that could lead to a remote code execution RCE vulnerability. This vulnerability is fixed in 1.24.2...

8.1CVSS8.3AI score0.01033EPSS
SaveExploits0References5
NVD
NVD
•added 2024/03/20 10:15 p.m.•61 views

CVE-2024-24050

Cross Site Scripting XSS vulnerability in Sourcecodester Workout Journal App 1.0 allows attackers to run arbitrary code via parameters firstname and lastname in /add-user.php...

4.7CVSS5.9AI score0.00443EPSS
SaveExploits4References1
NVD
NVD
•added 2024/03/15 8:15 p.m.•61 views

CVE-2024-28848

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The ‎CompiledRule::validateExpression method evaluates an SpEL expression using an StandardEvaluationContext, allowing the...

8.8CVSS9.4AI score0.07888EPSS
SaveExploits0References4
NVD
NVD
•added 2024/03/12 3:15 p.m.•61 views

CVE-2024-23112

An authorization bypass through user-controlled key vulnerability CWE-639 in FortiOS version 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.1 through 7.0.13, 6.4.7 through 6.4.14, and FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14 SSL-VPN may allow an authenticat...

8CVSS7.9AI score0.00663EPSS
SaveExploits0References1
NVD
NVD
•added 2024/02/18 8:15 a.m.•61 views

CVE-2023-6249

Signed to unsigned conversion esp32ipmsend...

9.8CVSS7.8AI score0.00441EPSS
SaveExploits1References1
NVD
NVD
•added 2024/02/09 1:15 a.m.•61 views

CVE-2024-23639

Micronaut Framework is a modern, JVM-based, full stack Java framework designed for building modular, easily testable JVM applications with support for Java, Kotlin and the Groovy language. Enabled but unsecured management endpoints are susceptible to drive-by localhost attacks. While not typical ...

7.8CVSS6.3AI score0.00261EPSS
SaveExploits0References2
NVD
NVD
•added 2024/02/07 3:15 p.m.•61 views

CVE-2024-25145

Stored cross-site scripting XSS vulnerability in the Portal Search module's Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, and older unsupported versions, and Liferay DXP 7.4 before update 8, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote...

9.6CVSS7.5AI score0.00563EPSS
SaveExploits0References1
NVD
NVD
•added 2024/01/30 4:15 p.m.•61 views

CVE-2024-21671

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning FL and Multi-Party Computation MPC. It is possible to find out usernames from the response time of login requests. This could aid attackers in credential attacks. Version 4.2.0 patches this...

3.7CVSS4AI score0.00401EPSS
SaveExploits0References2
NVD
NVD
•added 2024/01/11 1:15 a.m.•61 views

CVE-2024-21667

pimcore/customer-data-framework is the Customer Management Framework for management of customer data within Pimcore. An authenticated and unauthorized user can access the GDPR data extraction feature and query over the information returned, leading to customer data exposure. Permissions are not...

6.5CVSS6.3AI score0.00588EPSS
SaveExploits1References3
NVD
NVD
•added 2024/01/02 8:15 p.m.•61 views

CVE-2023-51652

OWASP AntiSamy .NET is a library for performing cleansing of HTML coming from untrusted sources. Prior to version 1.2.0, there is a potential for a mutation cross-site scripting mXSS vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerabilit...

6.1CVSS6.2AI score0.00447EPSS
SaveExploits0References3
NVD
NVD
•added 2023/12/25 6:15 a.m.•61 views

CVE-2022-39820

In Network Element Manager in NOKIA NFM-T R19.9, an Unprotected Storage of Credentials vulnerability occurs under /root/RestUploadManager.xml.DRC and /DEPOT/KECustom199/OTNEDRC/RestUploadManager.xml. A remote user, authenticated to the operating system, with access privileges to the directory /ro...

6.5CVSS0.00631EPSS
SaveExploits1References1
NVD
NVD
•added 2023/12/24 7:15 a.m.•61 views

CVE-2023-51767

OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks for authentication bypass because the integer value of authenticated in mmanswerauthpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim...

7CVSS0.00661EPSS
SaveExploits0References34
NVD
NVD
•added 2023/11/17 1:15 p.m.•61 views

CVE-2023-22272

Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Input Validation vulnerability that could lead to information disclosure by an unauthenticated attacker. Exploitation of this issue does not require user interaction...

7.5CVSS0.01392EPSS
SaveExploits0References1
NVD
NVD
•added 2023/11/08 11:15 p.m.•61 views

CVE-2023-45075

A memory leakage vulnerability was reported in the SWSMIShadow DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables...

6.7CVSS0.00216EPSS
SaveExploits0References1
NVD
NVD
•added 2023/10/28 2:15 p.m.•61 views

CVE-2023-5835

A vulnerability classified as problematic was found in hu60t hu60wap6. Affected by this vulnerability is the function markdown of the file src/class/ubbparser.php. The manipulation leads to cross site scripting. The attack can be launched remotely. This product does not use versioning. This is wh...

6.1CVSS4.4AI score0.00385EPSS
SaveExploits0References3
NVD
NVD
•added 2023/10/26 9:15 p.m.•61 views

CVE-2023-33558

An information disclosure vulnerability in the component users-grid-data.php of Ocomon before v4.0.1 allows attackers to obtain sensitive information such as e-mails and usernames...

7.5CVSS7.2AI score0.00527EPSS
SaveExploits0References2
NVD
NVD
•added 2023/10/16 8:15 p.m.•61 views

CVE-2023-5003

The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.10 stores sensitive LDAP logs in a buffer file when an administrator wants to export said logs. Unfortunately, this log file is never removed, and remains accessible to any users knowing the URL to do so...

7.5CVSS7.6AI score0.25855EPSS
SaveExploits2References1
NVD
NVD
•added 2023/10/06 7:15 p.m.•61 views

CVE-2023-21266

In multiple functions of ActivityManagerService.java, there is a possible way to escape Google Play protection due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

7.8CVSS7.8AI score0.00113EPSS
SaveExploits0References2
NVD
NVD
•added 2023/09/25 7:15 p.m.•61 views

CVE-2023-40581

yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines to be executed at various stages in its download steps through the --exec flag. This flag allows output template expansion in its argument, so that metadata values may be used in...

8.3CVSS8.7AI score0.0134EPSS
SaveExploits1References5
NVD
NVD
•added 2023/09/06 1:15 p.m.•61 views

CVE-2023-41942

A cross-site request forgery CSRF vulnerability in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers to clear the SQS queue...

4.3CVSS5AI score0.00328EPSS
SaveExploits0References2
NVD
NVD
•added 2023/08/28 1:15 a.m.•61 views

CVE-2023-26270

IBM Security Guardium Data Encryption IBM Guardium Cloud Key Manager GCKM 1.10.3 could allow a remote attacker to execute arbitrary code on the system, caused by an angular template injection flaw. By sending specially crafted request, an attacker could exploit this vulnerability to execute...

9.8CVSS8.4AI score0.00698EPSS
SaveExploits0References2
NVD
NVD
•added 2023/08/18 2:15 p.m.•61 views

CVE-2023-31218

Cross-Site Request Forgery CSRF leading to Stored Cross-Site Scripting XSS vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin = 1.0.6 versions...

7.1CVSS6.4AI score0.00212EPSS
SaveExploits0References1
NVD
NVD
•added 2023/08/14 9:15 p.m.•61 views

CVE-2023-40013

SVG Loader is a javascript library that fetches SVGs using XMLHttpRequests and injects the SVG code in the tag's place. According to the docs, svg-loader will strip all JS code before injecting the SVG file for security reasons but the input sanitization logic is not sufficient and can be trivial...

7.1CVSS6.6AI score0.00558EPSS
SaveExploits0References4
NVD
NVD
•added 2023/08/09 12:15 p.m.•61 views

CVE-2023-32781

A command injection vulnerability was identified in PRTG 23.2.84.1566 and earlier versions in the HL7 sensor where an authenticated user with write permissions could abuse the debug option to write new files that could potentially get executed by the EXE/Script sensor. The severity of this...

7.2CVSS7AI score0.14261EPSS
SaveExploits3References3
NVD
NVD
•added 2023/08/08 6:15 p.m.•61 views

CVE-2023-20589

An attacker with specialized hardware and physical access to an impacted device may be able to perform a voltage fault injection attack resulting in compromise of the ASP secure boot potentially leading to arbitrary code execution...

6.8CVSS6.8AI score0.00584EPSS
SaveExploits0References1
NVD
NVD
•added 2023/08/08 11:15 a.m.•61 views

CVE-2023-4203

Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by a Stored Cross-Site Scripting vulnerability, which can be triggered by authenticated users in the ping tool of the web-interface...

9CVSS8.2AI score0.01079EPSS
SaveExploits2References3
NVD
NVD
•added 2023/07/21 6:15 p.m.•61 views

CVE-2023-35392

Microsoft Edge Chromium-based Spoofing Vulnerability...

4.7CVSS4.6AI score0.00795EPSS
SaveExploits0References1
NVD
NVD
•added 2023/07/12 10:15 a.m.•61 views

CVE-2023-37582

The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1. When NameServer address are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the...

9.8CVSS9.7AI score0.90427EPSS
SaveExploits2References2
NVD
NVD
•added 2023/07/10 4:15 p.m.•61 views

CVE-2023-28989

Cross-Site Request Forgery CSRF vulnerability in weDevs Happy Addons for Elementor plugin = 3.8.2 versions...

8.8CVSS5.8AI score0.00321EPSS
SaveExploits0References1
NVD
NVD
•added 2023/07/06 1:15 p.m.•61 views

CVE-2023-37242

Vulnerability of commands from the modem being intercepted in the atcmdserver module. Attackers may exploit this vulnerability to rewrite the non-volatile random-access memory NVRAM, or facilitate the exploitation of other vulnerabilities...

9.8CVSS9.5AI score0.0045EPSS
SaveExploits0References2
NVD
NVD
•added 2023/06/08 2:15 a.m.•61 views

CVE-2023-2986

The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to insufficient encryption on the user being supplied during the abandoned cart link decode through the plugin. This allows unauthenticated...

9.8CVSS9.8AI score0.42544EPSS
SaveExploits5References8
NVD
NVD
•added 2023/06/03 5:15 a.m.•61 views

CVE-2023-2405

The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.0. This is due to missing nonce validation in the vcita-callback.php file. This makes it possible for unauthenticated attackers to modify the plugin's settin...

6.5CVSS5.9AI score0.00335EPSS
SaveExploits2References4
NVD
NVD
•added 2023/06/02 12:15 p.m.•61 views

CVE-2023-28469

An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to gain access to already freed memory. This affects Valhall r29p0 through r42p0 before r43p0, and Arm's GPU Architecture Gen5 r41p0 through r42p0 before r43p0...

5.5CVSS5.6AI score0.00182EPSS
SaveExploits0References1
NVD
NVD
•added 2023/05/24 4:15 p.m.•61 views

CVE-2023-33946

The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual instances, which allows remote authenticated users in one virtual instance to view objects in a different virtual instance via OAuth 2 scope...

4.3CVSS3.8AI score0.00608EPSS
SaveExploits0References1
Total number of security vulnerabilities5000