Lucene search
+L
NvdMost viewed

378756 matches found

NVD
NVD
•added 2021/10/06 8:15 p.m.•48 views

CVE-2021-34698

A vulnerability in the proxy service of Cisco AsyncOS for Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to exhaust system memory and cause a denial of service DoS condition on an affected device. This vulnerability is due to improper memory management in the pro...

8.6CVSS0.01432EPSS
SaveExploits0References1
NVD
NVD
•added 2021/10/04 10:15 a.m.•48 views

CVE-2021-22557

SLO generator allows for loading of YAML files that if crafted in a specific format can allow for code execution within the context of the SLO Generator. We recommend upgrading SLO Generator past https://github.com/google/slo-generator/pull/173...

7.8CVSS0.0158EPSS
SaveExploits4References2
NVD
NVD
•added 2021/09/30 11:15 a.m.•48 views

CVE-2021-41290

ECOA BAS controller suffers from an arbitrary file write and path traversal vulnerability. Using the POST parameters, unauthenticated attackers can remotely set arbitrary values for location and content type and gain the possibility to execute arbitrary code on the affected device...

10CVSS0.02322EPSS
SaveExploits1References1
NVD
NVD
•added 2021/09/14 11:15 a.m.•48 views

CVE-2021-37200

A vulnerability has been identified in SINEC NMS All versions V1.0 SP1. An attacker with access to the webserver of an affected system could download arbitrary files from the underlying filesystem by sending a specially crafted HTTP request...

7.7CVSS0.3738EPSS
SaveExploits0References1
NVD
NVD
•added 2021/09/06 11:15 a.m.•48 views

CVE-2021-24435

The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in an href attribute, leading to Reflected Cross-Site Scripting issues...

6.1CVSS0.01785EPSS
SaveExploits2References1
NVD
NVD
•added 2021/09/01 8:15 p.m.•48 views

CVE-2021-39185

Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null...

9.1CVSS0.00594EPSS
SaveExploits0References2
NVD
NVD
•added 2021/08/29 8:15 p.m.•48 views

CVE-2021-40172

Zoho ManageEngine Log360 before Build 5219 allows a CSRF attack on proxy settings...

8.8CVSS0.00994EPSS
SaveExploits0References1
NVD
NVD
•added 2021/08/03 12:15 p.m.•48 views

CVE-2021-35265

A reflected cross-site scripting XSS vulnerability in MaxSite CMS before V106 via product/page/ allows remote attackers to inject arbitrary web script to a page...

6.1CVSS0.03436EPSS
SaveExploits1References2
NVD
NVD
•added 2021/07/21 12:15 a.m.•48 views

CVE-2021-2326

Vulnerability in the Database Vault component of Oracle Database Server. Supported versions that are affected are 12.2.0.1 and 19c. Easily exploitable vulnerability allows high privileged attacker having DBA privilege with network access via Oracle Net to compromise Database Vault. Successful...

4CVSS0.00763EPSS
SaveExploits0References1
NVD
NVD
•added 2021/07/20 11:15 a.m.•48 views

CVE-2021-22125

An instance of improper neutralization of special elements in the sniffer module of FortiSandbox before 3.2.2 may allow an authenticated administrator to execute commands on the underlying system's shell via altering the content of its configuration file...

9CVSS0.0141EPSS
SaveExploits0References1
NVD
NVD
•added 2021/07/06 12:15 p.m.•48 views

CVE-2021-32559

An integer overflow exists in pywin32 prior to version b301 when adding an access control entry ACE to an access control list ACL that would cause the size to be greater than 65535 bytes. An attacker who successfully exploited this vulnerability could crash the vulnerable process...

6.5CVSS0.01729EPSS
SaveExploits0References4
NVD
NVD
•added 2021/07/01 3:15 a.m.•48 views

CVE-2018-25017

RawSpeed aka librawspeed 3.1 has a heap-based buffer overflow in TableLookUp::setTable...

9.8CVSS0.01737EPSS
SaveExploits0References3
NVD
NVD
•added 2021/06/21 7:15 p.m.•48 views

CVE-2020-19511

Cross Site Scriptiong vulnerability in Typesetter 5.1 via the !1 className and !2 Description fields in index.php/Admin/Classes,...

6.1CVSS0.00819EPSS
SaveExploits1References2
NVD
NVD
•added 2021/06/12 4:15 a.m.•48 views

CVE-2021-32554

It was discovered that readfile in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg package apport hooks, it could expose private data to other local users...

7.3CVSS0.00289EPSS
SaveExploits0References1
NVD
NVD
•added 2021/06/10 12:15 p.m.•48 views

CVE-2021-20293

A reflected Cross-Site Scripting XSS flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final, where it did not properly handle URL encoding when calling @javax.ws.rs.PathParam without any @Produces MediaType. This flaw allows an attacker to launch a reflected XSS attack. The...

6.1CVSS0.00856EPSS
SaveExploits0References2
NVD
NVD
•added 2021/06/07 10:15 p.m.•48 views

CVE-2021-32670

Datasette is an open source multi-tool for exploring and publishing data. The ?trace=1 debugging feature in Datasette does not correctly escape generated HTML, resulting in a reflected cross-site scripting vulnerability. This vulnerability is particularly relevant if your Datasette installation...

7.2CVSS0.0096EPSS
SaveExploits0References5
NVD
NVD
•added 2021/05/21 11:15 p.m.•48 views

CVE-2021-33514

Certain NETGEAR devices are affected by command injection by an unauthenticated attacker via the vulnerable /sqfs/lib/libsal.so.0.0 library used by a CGI application, as demonstrated by setup.cgi?token=';$HTTPUSERAGENT;' with an OS command in the User-Agent field. This affects GC108P before...

10CVSS0.07863EPSS
SaveExploits2References2
NVD
NVD
•added 2021/05/20 1:15 p.m.•48 views

CVE-2021-29659

ownCloud 10.7 has an incorrect access control vulnerability, leading to remote information disclosure. Due to a bug in the related API endpoint, the attacker can enumerate all users in a single request by entering three whitespaces. Secondary, the retrieval of all users on a large instance could...

6.5CVSS0.01327EPSS
SaveExploits0References2
NVD
NVD
•added 2021/05/14 8:15 p.m.•48 views

CVE-2021-29578

TensorFlow is an end-to-end open source platform for machine learning. The implementation of tf.rawops.FractionalAvgPoolGrad is vulnerable to a heap buffer overflow. The...

7.8CVSS0.00211EPSS
SaveExploits1References2
NVD
NVD
•added 2021/05/14 8:15 p.m.•48 views

CVE-2021-29559

TensorFlow is an end-to-end open source platform for machine learning. An attacker can access data outside of bounds of heap allocated array in tf.rawops.UnicodeEncode. This is because the...

7.1CVSS0.00198EPSS
SaveExploits1References2
NVD
NVD
•added 2021/05/14 8:15 p.m.•48 views

CVE-2021-29530

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a null pointer dereference by providing an invalid permutation to tf.rawops.SparseMatrixSparseCholesky. This is because the...

7.8CVSS0.00232EPSS
SaveExploits1References2
NVD
NVD
•added 2021/05/11 3:15 p.m.•48 views

CVE-2021-21651

Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to obtain the list of configured profiles...

4.3CVSS0.00733EPSS
SaveExploits0References1
NVD
NVD
•added 2021/04/29 5:15 p.m.•48 views

CVE-2021-31429

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.5-47309. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists withi...

8.2CVSS0.00442EPSS
SaveExploits0References2
NVD
NVD
•added 2021/04/29 5:15 p.m.•48 views

CVE-2021-31418

This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw...

6.5CVSS0.0043EPSS
SaveExploits0References2
NVD
NVD
•added 2021/04/23 4:15 p.m.•48 views

CVE-2019-25028

Missing variable sanitization in Grid component in com.vaadin:vaadin-server versions 7.4.0 through 7.7.19 Vaadin 7.4.0 through 7.7.19, and 8.0.0 through 8.8.4 Vaadin 8.0.0 through 8.8.4 allows attacker to inject malicious JavaScript via unspecified vector...

6.1CVSS0.00923EPSS
SaveExploits0References3
NVD
NVD
•added 2021/04/22 8:15 p.m.•48 views

CVE-2021-0250

In segment routing traffic engineering SRTE environments where the BGP Monitoring Protocol BMP feature is enable, a vulnerability in the Routing Protocol Daemon RPD process of Juniper Networks Junos OS allows an attacker to send a specific crafted BGP update message causing the RPD service to cor...

7.5CVSS0.0102EPSS
SaveExploits0References1
NVD
NVD
•added 2021/04/18 7:15 p.m.•48 views

CVE-2021-23374

This affects all versions of package ps-visitor. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization...

9.8CVSS0.01336EPSS
SaveExploits1References2
NVD
NVD
•added 2021/04/13 8:15 p.m.•48 views

CVE-2021-29440

Grav is a file based Web-platform. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the...

8.4CVSS0.30623EPSS
SaveExploits5References4
NVD
NVD
•added 2021/04/09 1:15 p.m.•48 views

CVE-2021-25326

Skyworth Digital Technology RN510 V.3.1.0.4 is affected by an incorrect access control vulnerability in/cgi-bin/testversion.asp. If Wi-Fi is connected but an unauthenticated user visits a URL, the SSID password and web UI password may be disclosed...

5.4CVSS0.01486EPSS
SaveExploits3References3
NVD
NVD
•added 2021/04/08 6:15 p.m.•48 views

CVE-2020-14104

A RACE CONDITION on XQBACKUP causes a decompression path error on Xiaomi router AX3600 with ROM version =1.0.50...

8.1CVSS0.00665EPSS
SaveExploits0References1
NVD
NVD
•added 2021/03/31 9:15 p.m.•48 views

CVE-2021-22538

A privilege escalation vulnerability impacting the Google Exposure Notification Verification Server versions prior to 0.23.1, allows an attacker who 1 has UserWrite permissions and 2 is using a carefully crafted request or malicious proxy, to create another user with higher privileges than their...

8.8CVSS0.00718EPSS
SaveExploits0References4
NVD
NVD
•added 2021/03/30 3:15 p.m.•48 views

CVE-2021-27268

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

7.8CVSS0.02491EPSS
SaveExploits0References2
NVD
NVD
•added 2021/03/30 8:15 a.m.•48 views

CVE-2021-26919

Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker...

8.8CVSS0.22588EPSS
SaveExploits1References9
NVD
NVD
•added 2021/03/25 4:15 p.m.•48 views

CVE-2021-22659

Rockwell Automation MicroLogix 1400 Version 21.6 and below may allow a remote unauthenticated attacker to send a specially crafted Modbus packet allowing the attacker to retrieve or modify random values in the register. If successfully exploited, this may lead to a buffer overflow resulting in a...

8.6CVSS0.01719EPSS
SaveExploits0References2
NVD
NVD
•added 2021/03/24 5:15 p.m.•48 views

CVE-2019-19352

An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/presto as shipped in Red Hat Openshift 4. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges...

7CVSS0.00255EPSS
SaveExploits0References2
NVD
NVD
•added 2021/03/15 5:15 p.m.•48 views

CVE-2021-23355

This affects all versions of package ps-kill. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization in the index.js file. PoC provided by...

9.8CVSS0.01201EPSS
SaveExploits1References1
NVD
NVD
•added 2021/03/11 4:15 p.m.•48 views

CVE-2021-27050

HEVC Video Extensions Remote Code Execution Vulnerability...

7.8CVSS0.0231EPSS
SaveExploits0References1
NVD
NVD
•added 2021/03/05 9:15 p.m.•48 views

CVE-2021-3377

The npm package ansiup converts ANSI escape codes into HTML. In ansiup v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization, this feature is affected by a cross-site scripting XSS vulnerability. This issue is fixed in v5.0.0...

6.1CVSS0.08EPSS
SaveExploits1References3
NVD
NVD
•added 2021/03/05 2:15 a.m.•48 views

CVE-2021-27964

SonLogger before 6.4.1 is affected by Unauthenticated Arbitrary File Upload. An attacker can send a POST request to /Config/SaveUploadedHotspotLogoFile without any authentication or session header. There is no check for the file extension or content of the uploaded file...

9.8CVSS0.47519EPSS
SaveExploits5References3
NVD
NVD
•added 2021/02/25 8:15 p.m.•48 views

CVE-2021-3406

A flaw was found in keylime 5.8.1 and older. The issue in the Keylime agent and registrar code invalidates the cryptographic chain of trust from the Endorsement Key certificate to agent attestations...

9.8CVSS0.00658EPSS
SaveExploits0References3
NVD
NVD
•added 2021/02/22 7:15 a.m.•48 views

CVE-2020-11163

Possible buffer overflow while updating ikev2 parameters due to lack of check of input validation for certain parameters received from the ePDG server in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile...

10CVSS0.00818EPSS
SaveExploits0References1
NVD
NVD
•added 2021/02/19 11:15 p.m.•48 views

CVE-2020-12668

Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. This could allow for abuse of the application class loader, including Arbitrary File Disclosure...

6.8CVSS0.01814EPSS
SaveExploits1References5
NVD
NVD
•added 2021/02/09 8:15 p.m.•48 views

CVE-2021-26551

An issue was discovered in SmartFoxServer 2.17.0. An attacker can execute arbitrary Python code, and bypass the javashell.py protection mechanism, by creating /config/ConsoleModuleUnlock.txt and editing /config/admin/admintool.xml to enable the Console module...

8.8CVSS0.02609EPSS
SaveExploits3References3
NVD
NVD
•added 2021/02/09 5:15 p.m.•48 views

CVE-2020-26998

A vulnerability has been identified in JT2Go All versions V13.1.0.2, Teamcenter Visualization All versions V13.1.0.2. Affected applications lack proper validation of user-supplied data when parsing of PAR files. This could result in a memory access past the end of an allocated buffer. An attacker...

5.5CVSS0.00646EPSS
SaveExploits0References4
NVD
NVD
•added 2021/02/04 7:15 a.m.•48 views

CVE-2020-6088

An exploitable denial of service vulnerability exists in the ENIP Request Path Network Segment functionality of Allen-Bradley Flex IO 1794-AENT/B 4.003. A specially crafted network request can cause a loss of communications with the device resulting in denial-of-service. An attacker can send a...

7.5CVSS0.03454EPSS
SaveExploits1References1
NVD
NVD
•added 2021/01/26 6:16 p.m.•48 views

CVE-2021-25907

An issue was discovered in the containers crate before 0.9.11 for Rust. When a panic occurs, a util::mutate,mutate2 double drop can be performed...

9.8CVSS9.4AI score0.01552EPSS
SaveExploits1References1
NVD
NVD
•added 2021/01/21 10:15 a.m.•48 views

CVE-2020-11179

Arbitrary read and write to kernel addresses by temporarily overwriting ring buffer pointer and creating a race condition. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon...

7CVSS6.9AI score0.00316EPSS
SaveExploits0References2
NVD
NVD
•added 2021/01/12 9:15 p.m.•48 views

CVE-2020-25226

A vulnerability has been identified in SCALANCE X-200 switch family incl. SIPLUS NET variants All versions V5.2.5, SCALANCE X-200IRT switch family incl. SIPLUS NET variants All versions V5.5.0. The web server of the affected devices contains a vulnerability that may lead to a buffer overflow...

10CVSS9.6AI score0.01907EPSS
SaveExploits0References1
NVD
NVD
•added 2021/01/12 3:15 p.m.•48 views

CVE-2021-21446

SAP NetWeaver AS ABAP, versions 740, 750, 751, 752, 753, 754, 755, allows an unauthenticated attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service, this has a high impact on the availability of the service...

7.5CVSS7.5AI score0.01441EPSS
SaveExploits0References2
NVD
NVD
•added 2020/12/16 8:15 a.m.•48 views

CVE-2020-35476

A remote code execution vulnerability occurs in OpenTSDB through 2.4.0 via command injection in the yrange parameter. The yrange value is written to a gnuplot file in the /tmp directory. This file is then executed via the mygnuplot.sh shell script. tsd/GraphHandler.java attempted to prevent comma...

9.8CVSS9.9AI score0.8533EPSS
SaveExploits5References2
Total number of security vulnerabilities5000