Lucene search
+L
NvdMost viewed

398848 matches found

NVD
NVD
•added 2023/01/12 1:15 a.m.•55 views

CVE-2023-0227

Insufficient Session Expiration in GitHub repository pyload/pyload prior to 0.5.0b3.dev36...

8.3CVSS7AI score0.00655EPSS
SaveExploits1References2
NVD
NVD
•added 2023/01/10 10:15 p.m.•55 views

CVE-2023-21678

Windows Print Spooler Elevation of Privilege Vulnerability...

7.8CVSS8.2AI score0.0058EPSS
SaveExploits0References1
NVD
NVD
•added 2023/01/10 9:15 p.m.•55 views

CVE-2022-38393

A denial of service vulnerability exists in the cfgserver cmprocessConnDiagPktList opcode of Asus RT-AX82U 3.0.0.4.38649674-ge182230 router's configuration service. A specially-crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this...

7.5CVSS7.3AI score0.18847EPSS
SaveExploits1References2
NVD
NVD
•added 2023/01/05 11:15 p.m.•55 views

CVE-2021-32828

The Nuxeo Platform is an open source content management platform for building business applications. In version 11.5.109, the oauth2 REST API is vulnerable to Reflected Cross-Site Scripting XSS. This XSS can be escalated to Remote Code Execution RCE by levering the automation API...

6.1CVSS5.9AI score0.0071EPSS
SaveExploits1References2
NVD
NVD
•added 2022/12/13 8:15 a.m.•55 views

CVE-2022-23505

Passport-wsfed-saml2 is a ws-federation protocol and SAML2 tokens authentication provider for Passport. In versions prior to 4.6.3, a remote attacker may be able to bypass WSFed authentication on a website using passport-wsfed-saml2. A successful attack requires that the attacker is in possession...

7.5CVSS0.00771EPSS
SaveExploits0References1
NVD
NVD
•added 2022/12/12 9:15 a.m.•55 views

CVE-2022-20968

A vulnerability in the Cisco Discovery Protocol processing feature of Cisco IP Phone 7800 and 8800 Series firmware could allow an unauthenticated, adjacent attacker to cause a stack overflow on an affected device. This vulnerability is due to insufficient input validation of received Cisco...

8.8CVSS0.06099EPSS
SaveExploits0References1
NVD
NVD
•added 2022/12/01 12:15 a.m.•55 views

CVE-2022-40204

A cross-site scripting XSS vulnerability exists in all current versions of Digital Alert Systems DASDEC software via the Host Header in undisclosed pages after login...

5.4CVSS0.0035EPSS
SaveExploits0References1
NVD
NVD
•added 2022/11/30 11:15 p.m.•55 views

CVE-2022-46162

discourse-bbcode is the official BBCode plugin for Discourse. Prior to commit 91478f5, CSS injection can occur when rendering content generated with the discourse-bccode plugin. This vulnerability only affects sites which have the discourse-bbcode plugin installed and enabled. This issue is patch...

9.8CVSS0.01142EPSS
SaveExploits1References2
NVD
NVD
•added 2022/11/23 8:15 p.m.•55 views

CVE-2022-41931

xwiki-platform-icon-ui is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code 'Eval Injection'. Any user with view rights on commonly accessible documents including the icon picker macro can execute arbitrary Groovy, Python or Velocity code in XWiki due to improper...

9.9CVSS0.0127EPSS
SaveExploits1References3
NVD
NVD
•added 2022/11/08 8:15 a.m.•55 views

CVE-2022-39343

Azure RTOS FileX is a FAT-compatible file system that’s fully integrated with Azure RTOS ThreadX. In versions before 6.2.0, the Fault Tolerant feature of Azure RTOS FileX includes integer under and overflows which may be exploited to achieve buffer overflow and modify memory contents. When a vali...

7.8CVSS0.0089EPSS
SaveExploits1References2
NVD
NVD
•added 2022/10/26 7:15 p.m.•55 views

CVE-2022-39359

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, custom GeoJSON map URL address would follow redirects to addresses that were otherwise disallowed, like link-local or private-network. This issue is patched in versions...

6.5CVSS0.00609EPSS
SaveExploits0References2
NVD
NVD
•added 2022/10/19 4:15 p.m.•55 views

CVE-2022-43422

Jenkins Compuware Topaz Utilities Plugin 1.0.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process...

5.3CVSS0.00735EPSS
SaveExploits0References2
NVD
NVD
•added 2022/10/18 7:15 p.m.•55 views

CVE-2022-39198

A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.17 and prior versions; Apache Dubbo 3.0.x version 3.0.11 and prior versions; Apache Dubbo 3.1.x version...

9.8CVSS0.02624EPSS
SaveExploits0References1
NVD
NVD
•added 2022/10/11 9:15 p.m.•55 views

CVE-2022-41177

Due to lack of proper memory management, when a victim opens a manipulated Iges Part and Assembly .igs, .iges, CoreCadTranslator.exe file received from untrusted sources in SAP 3D Visual Enterprise Author - version 9, it is possible that a Remote Code Execution can be triggered when payload force...

7.8CVSS0.0054EPSS
SaveExploits0References2
NVD
NVD
•added 2022/09/29 3:15 p.m.•55 views

CVE-2022-39252

matrix-rust-sdk is an implementation of a Matrix client-server library in Rust, and matrix-sdk-crypto is the Matrix encryption library. Prior to version 0.6, when a user requests a room key from their devices, the software correctly remembers the request. When the user receives a forwarded room...

8.6CVSS0.00616EPSS
SaveExploits0References4
NVD
NVD
•added 2022/09/24 2:15 a.m.•55 views

CVE-2022-36025

Besu is a Java-based Ethereum client. In versions newer than 22.1.3 and prior to 22.7.1, Besu is subject to an Incorrect Conversion between Numeric Types. An error in 32 bit signed and unsigned types in the calculation of available gas in the CALL operations including DELEGATECALL results in...

9.1CVSS0.01046EPSS
SaveExploits0References1
NVD
NVD
•added 2022/09/16 8:15 p.m.•55 views

CVE-2022-35952

TensorFlow is an open source platform for machine learning. The UnbatchGradOp function takes an argument id that is assumed to be a scalar. A nonscalar id can trigger a CHECK failure and crash the program. It also requires its argument batchindex to contain three times the number of elements as...

7.5CVSS0.00716EPSS
SaveExploits0References3
NVD
NVD
•added 2022/09/15 12:15 p.m.•55 views

CVE-2022-3224

Misinterpretation of Input in GitHub repository ionicabizau/parse-url prior to 8.1.0...

9.4CVSS0.00789EPSS
SaveExploits1References2
NVD
NVD
•added 2022/08/01 9:15 p.m.•55 views

CVE-2022-31192

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI "Request a Copy" feature does not properly escape values submitted and stored from the "Request a Copy" form. This means that item...

7.1CVSS0.00768EPSS
SaveExploits0References3
NVD
NVD
•added 2022/08/01 9:15 p.m.•55 views

CVE-2022-31195

DSpace open source software is a repository application which provides durable access to digital resources. In affected versions the ItemImportServiceImpl is vulnerable to a path traversal vulnerability. This means a malicious SAF simple archive format package could cause a file/directory to be...

7.2CVSS0.01406EPSS
SaveExploits0References3
NVD
NVD
•added 2022/07/22 4:15 a.m.•55 views

CVE-2022-31172

OpenZeppelin Contracts is a library for smart contract development. Versions 4.1.0 until 4.7.1 are vulnerable to the SignatureChecker reverting. SignatureChecker.isValidSignatureNow is not expected to revert. However, an incorrect assumption about Solidity 0.8's abi.decode allows some cases to...

7.5CVSS0.00488EPSS
SaveExploits0References2
NVD
NVD
•added 2022/06/24 3:15 p.m.•55 views

CVE-2022-1746

The authentication mechanism used by poll workers to administer voting using the tested version of Dominion Voting Systems ImageCast X can expose cryptographic secrets used to protect election information. An attacker could leverage this vulnerability to gain access to sensitive information and...

7.6CVSS0.00287EPSS
SaveExploits0References1
NVD
NVD
•added 2022/06/21 3:15 p.m.•55 views

CVE-2022-2068

In addition to the crehash shell command injection identified in CVE-2022-1292, further circumstances where the crehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there...

10CVSS0.95404EPSS
SaveExploits1References11
NVD
NVD
•added 2022/06/21 1:15 p.m.•55 views

CVE-2022-33139

A vulnerability has been identified in Cerberus DMS All versions, Desigo CC All versions, Desigo CC Compact All versions, SIMATIC WinCC OA V3.16 All versions in default configuration, SIMATIC WinCC OA V3.17 All versions in non-default configuration, SIMATIC WinCC OA V3.18 All versions in...

9.8CVSS0.01235EPSS
SaveExploits0References2
NVD
NVD
•added 2022/06/14 9:15 p.m.•55 views

CVE-2022-29241

Jupyter Server provides the backend i.e. the core services, APIs, and REST endpoints for Jupyter web applications like Jupyter Notebook. Prior to version 1.17.1, if notebook server is started with a value of rootdir that contains the starting user's home directory, then the underlying REST API ca...

9CVSS0.00948EPSS
SaveExploits0References1
NVD
NVD
•added 2022/06/12 12:15 p.m.•55 views

CVE-2021-41750

A cross-site scripting XSS vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /index.php?action=seomatic/file/seo-file-link with url parameter containing the base64 encoded URL of a malicious web page / file and fileName...

6.1CVSS0.01083EPSS
SaveExploits0References3
NVD
NVD
•added 2022/05/31 8:15 p.m.•55 views

CVE-2022-31005

Vapor is an HTTP web framework for Swift. Users of Vapor prior to version 4.60.3 with FileMiddleware enabled are vulnerable to an integer overflow vulnerability that can crash the application. Version 4.60.3 contains a patch for this issue. As a workaround, disable FileMiddleware and serve via a...

7.5CVSS0.02076EPSS
SaveExploits1References3
NVD
NVD
•added 2022/05/25 9:15 p.m.•55 views

CVE-2022-29252

XWiki Platform Wiki UI Main Wiki is a package for managing subwikis. Starting with version 5.3-milestone-2, XWiki Platform Wiki UI Main Wiki contains a possible cross-site scripting vector in the WikiManager.JoinWiki wiki page related to the "requestJoin" field. The issue is patched in versions...

7.4CVSS0.00992EPSS
SaveExploits0References3
NVD
NVD
•added 2022/05/17 3:15 p.m.•55 views

CVE-2022-30961

Jenkins Autocomplete Parameter Plugin 1.1 and earlier does not escape the name of Dropdown Autocomplete and Auto Complete String parameters on views displaying parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

5.4CVSS0.00774EPSS
SaveExploits0References1
NVD
NVD
•added 2022/05/06 12:15 a.m.•55 views

CVE-2022-29161

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The XWiki Crypto API will generate X509 certificates signed by default using SHA1 with RSA, which is not considered safe anymore for use in certificate signatures, due to the risk of collision...

9.8CVSS0.00412EPSS
SaveExploits0References3
NVD
NVD
•added 2022/05/05 5:15 p.m.•55 views

CVE-2022-29474

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, a directory traversal vulnerability exists in iControl SOAP that allows an authenticated attacker with at...

4.3CVSS0.01574EPSS
SaveExploits0References1
NVD
NVD
•added 2022/04/04 4:15 p.m.•55 views

CVE-2022-0901

The Ad Inserter Free and Pro WordPress plugins before 2.7.12 do not sanitise and escape the REQUESTURI before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters...

6.1CVSS0.03596EPSS
SaveExploits4References2
NVD
NVD
•added 2022/04/01 12:15 p.m.•55 views

CVE-2022-24181

Cross-site scripting XSS via Host Header injection in PKP Open Journals System 2.4.8 = 3.3 allows remote attackers to inject arbitary code via the X-Forwarded-Host Header...

6.1CVSS0.0608EPSS
SaveExploits3References1
NVD
NVD
•added 2022/04/01 5:15 a.m.•55 views

CVE-2021-35088

Possible out of bound read due to improper validation of IE length during SSID IE parse when channel is DFS in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure...

9.1CVSS0.0085EPSS
SaveExploits0References1
NVD
NVD
•added 2022/03/16 3:15 p.m.•55 views

CVE-2021-0957

In NotificationStackScrollLayout of NotificationStackScrollLayout.java, there is a possible way to bypass Factory Reset Protections. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

7.8CVSS0.00135EPSS
SaveExploits0References1
NVD
NVD
•added 2022/03/11 6:15 p.m.•55 views

CVE-2022-0001

Non-transparent sharing of branch predictor selectors between contexts in some IntelR Processors may allow an authorized user to potentially enable information disclosure via local access...

6.5CVSS0.00508EPSS
SaveExploits0References7
NVD
NVD
•added 2022/02/09 4:15 p.m.•55 views

CVE-2021-46158

A vulnerability has been identified in Simcenter Femap V2020.2 All versions, Simcenter Femap V2021.1 All versions. Affected application contains a stack based buffer overflow vulnerability while parsing NEU files. This could allow an attacker to execute code in the context of the current process...

7.8CVSS0.01774EPSS
SaveExploits0References4
NVD
NVD
•added 2022/02/09 4:15 p.m.•55 views

CVE-2021-37204

A vulnerability has been identified in SIMATIC Drive Controller family All versions = V2.9.2 = V21.9 = V4.5.0 = V2.9.2 = V21.9 = V4.0 V4.0 SP1, SIPLUS TIM 1531 IRC All versions V2.3.6, TIM 1531 IRC All versions V2.3.6. An unauthenticated attacker could cause a denial-of-service condition in a PLC...

7.5CVSS0.02181EPSS
SaveExploits0References1
NVD
NVD
•added 2022/02/04 11:15 p.m.•55 views

CVE-2022-23589

Tensorflow is an Open Source Machine Learning Framework. Under certain scenarios, Grappler component of TensorFlow can trigger a null pointer dereference. There are 2 places where this can occur, for the same malicious alteration of a SavedModel file fixing the first one would trigger the same...

6.5CVSS0.01106EPSS
SaveExploits1References5
NVD
NVD
•added 2022/02/04 11:15 p.m.•55 views

CVE-2022-23571

Tensorflow is an Open Source Machine Learning Framework. When decoding a tensor from protobuf, a TensorFlow process can encounter cases where a CHECK assertion is invalidated based on user controlled arguments, if the tensors have an invalid dtype and 0 elements or an invalid shape. This allows...

6.5CVSS0.00473EPSS
SaveExploits0References2
NVD
NVD
•added 2022/02/03 12:15 p.m.•55 views

CVE-2022-21731

Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for ConcatV2 can be used to trigger a denial of service attack via a segfault caused by a type confusion. The axis argument is translated into concatdim in the ConcatShapeHelper helper function. Then, a...

6.5CVSS0.00852EPSS
SaveExploits1References4
NVD
NVD
•added 2022/01/31 9:15 p.m.•55 views

CVE-2022-21659

Flask-AppBuilder is an application development framework, built on top of the Flask web framework. In affected versions there exists a user enumeration vulnerability. This vulnerability allows for a non authenticated user to enumerate existing accounts by timing the response time from the server...

5.3CVSS0.00953EPSS
SaveExploits0References2
NVD
NVD
•added 2022/01/19 11:15 a.m.•55 views

CVE-2021-31854

A command Injection Vulnerability in McAfee Agent MA for Windows prior to 5.7.5 allows local users to inject arbitrary shell code into the file cleanup.exe. The malicious clean.exe file is placed into the relevant folder and executed by running the McAfee Agent deployment feature located in the...

9.3CVSS0.01012EPSS
SaveExploits0References1
NVD
NVD
•added 2022/01/13 10:15 p.m.•55 views

CVE-2021-34997

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

8.8CVSS0.04248EPSS
SaveExploits0References1
NVD
NVD
•added 2022/01/03 10:15 p.m.•55 views

CVE-2021-37098

Hilinksvc service exists a Data Processing Errors vulnerability .Successful exploitation of this vulnerability may cause application crash...

7.5CVSS0.00655EPSS
SaveExploits0References1
NVD
NVD
•added 2021/12/27 12:15 a.m.•55 views

CVE-2021-45699

An issue was discovered in the ckb crate before 0.40.0 for Rust. Remote attackers may be able to conduct a 51% attack against the Nervos CKB blockchain by triggering an inability to allocate memory for the misbehavior HashMap...

7.8CVSS0.01466EPSS
SaveExploits0References2
NVD
NVD
•added 2021/12/22 9:15 p.m.•55 views

CVE-2021-43853

Ajax.NET Professional AjaxPro is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to JavaScript object injection which may result in cross site scripting when leveraged by a malicious user. The affected core relates to JavaScript object creation...

8.7CVSS0.00824EPSS
SaveExploits0References3
NVD
NVD
•added 2021/12/06 4:15 p.m.•55 views

CVE-2021-24938

The WOOCS WordPress plugin before 1.3.7.1 does not sanitise and escape the key parameter of the woocsupdateprofilesdata AJAX action available to any authenticated user before outputting it back in the response, leading to a Reflected cross-Site Scripting issue...

6.1CVSS0.00795EPSS
SaveExploits2References1
NVD
NVD
•added 2021/12/01 1:15 a.m.•55 views

CVE-2021-40809

An issue was discovered in Jamf Pro before 10.32.0, aka PI-009921. An account can be granted incorrect privileges in response to authentication that uses specific sign-on workflows...

8.8CVSS0.01479EPSS
SaveExploits1References3
NVD
NVD
•added 2021/11/23 12:15 a.m.•55 views

CVE-2021-40828

Connections initialized by the AWS IoT Device SDK v2 for Java versions prior to 1.3.3, Python versions prior to 1.5.18, C++ versions prior to 1.12.7 and Node.js versions prior to 1.5.1 did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities CA in...

8.8CVSS0.00411EPSS
SaveExploits0References5
Total number of security vulnerabilities5000