Lucene search
+L
PrionMost viewed

213680 matches found

Prion
Prion
•added 2021/07/09 2:15 p.m.•44 views

Sql injection

The API call /InstallTab/exportFldr.asp is vulnerable to a semi-authenticated boolean-based blind SQL injection in the parameter fldrId. Detailed description --- Given the following request: GET /InstallTab/exportFldr.asp?fldrId=1’ HTTP/1.1 Host: 192.168.1.194 User-Agent: Mozilla/5.0 Macintosh;...

6.5CVSS9.6AI score0.85735EPSS
SaveExploits1References2Affected Software1
Prion
Prion
•added 2021/07/09 2:15 p.m.•44 views

Authentication flaw

Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client...

7.5CVSS9.2AI score0.85735EPSS
SaveExploits1References4Affected Software2
Prion
Prion
•added 2021/07/08 7:15 p.m.•44 views

Authorization

Multiple vulnerabilities in the web-based management interface of Cisco Business Process Automation BPA could allow an authenticated, remote attacker to elevate privileges to Administrator. These vulnerabilities are due to improper authorization enforcement for specific features and for access to...

4CVSS8.6AI score0.01091EPSS
SaveExploits0References1Affected Software1
Prion
Prion
•added 2021/06/22 3:15 p.m.•44 views

Session fixation

For Eclipse Jetty versions = 9.4.40, = 10.0.2, = 11.0.2, if an exception is thrown from the SessionListenersessionDestroyed method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being...

3.6CVSS5.4AI score0.00963EPSS
SaveExploits1References12Affected Software10
Prion
Prion
•added 2021/06/11 4:15 p.m.•44 views

Design/Logic Flaw

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client...

6.8CVSS8.1AI score0.60122EPSS
SaveExploits1References10Affected Software9
Prion
Prion
•added 2021/06/10 7:15 a.m.•44 views

Heap overflow

In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow...

7.5CVSS9.2AI score0.68289EPSS
SaveExploits0References13Affected Software7
Prion
Prion
•added 2021/05/06 1:15 p.m.•44 views

Design/Logic Flaw

Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters. Local users can alter the behavior of root processes because a recipient address can have a newline character...

7.2CVSS8.6AI score0.00376EPSS
SaveExploits1References1Affected Software1
Prion
Prion
•added 2021/04/27 6:15 a.m.•44 views

Design/Logic Flaw

DISPUTED Unbound before 1.9.5 allows an assertion failure and denial of service in synthcname. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited...

5CVSS8.3AI score0.01989EPSS
SaveExploits0References3Affected Software2
Prion
Prion
•added 2021/04/26 5:15 p.m.•44 views

Design/Logic Flaw

Use after free in Blink in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

6.8CVSS8.9AI score0.09401EPSS
SaveExploits0References6Affected Software2
Prion
Prion
•added 2021/04/22 10:15 p.m.•44 views

Code injection

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

4CVSS4.8AI score0.0278EPSS
SaveExploits0References7Affected Software3
Prion
Prion
•added 2021/04/06 5:15 a.m.•44 views

Improper access control

The Dashboard plugin through 1.0.2 for GLPI allows remote low-privileged users to bypass access control on viewing information about the last ten events, the connected users, and the users in the tech category. For example, plugins/dashboard/front/main2.php can be used...

4CVSS4.7AI score0.00806EPSS
SaveExploits0References2Affected Software1
Prion
Prion
•added 2021/03/25 10:15 a.m.•44 views

Design/Logic Flaw

In Apache SpamAssassin before 3.4.5, malicious rule configuration .cf files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3...

10CVSS9.2AI score0.06132EPSS
SaveExploits0References7Affected Software3
Prion
Prion
•added 2021/03/03 12:15 a.m.•44 views

Remote code execution

Microsoft Exchange Server Remote Code Execution Vulnerability...

6.8CVSS8AI score0.94008EPSS
SaveExploits5References1Affected Software1
Prion
Prion
•added 2021/02/24 5:15 p.m.•44 views

Remote code execution

The vSphere Client HTML5 contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects...

10CVSS9.8AI score0.99518EPSS
SaveExploits48References4Affected Software2
Prion
Prion
•added 2021/01/20 3:15 p.m.•44 views

Code injection

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Stored Procedure. Supported versions that are affected are 8.0.22 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

6.8CVSS4.9AI score0.0183EPSS
SaveExploits0References3Affected Software1
Prion
Prion
•added 2021/01/20 3:15 p.m.•44 views

Code injection

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Stored Procedure. Supported versions that are affected are 8.0.22 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. While t...

6.8CVSS6.2AI score0.02157EPSS
SaveExploits0References3Affected Software1
Prion
Prion
•added 2021/01/18 8:15 p.m.•44 views

Directory traversal

Tar.php in ArchiveTar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948...

5CVSS7.3AI score0.70595EPSS
SaveExploits2References10Affected Software4
Prion
Prion
•added 2020/11/17 2:15 a.m.•44 views

Privilege escalation

BinaryNights ForkLift 3.x before 3.4 has a local privilege escalation vulnerability because the privileged helper tool implements an XPC interface that allows file operations to any process copy, move, delete as root and changing permissions...

7.2CVSS7.7AI score0.00743EPSS
SaveExploits1References2Affected Software1
Prion
Prion
•added 2020/10/21 3:15 p.m.•44 views

Design/Logic Flaw

Vulnerability in the Java SE product of Oracle Java SE component: Libraries. Supported versions that are affected are Java SE: 11.0.8 and 15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of th...

5CVSS4.3AI score0.0316EPSS
SaveExploits0References7Affected Software7
Prion
Prion
•added 2020/10/21 3:15 p.m.•44 views

Code injection

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: LDAP Auth. Supported versions that are affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromi...

6.8CVSS5.1AI score0.01802EPSS
SaveExploits0References3Affected Software1
Prion
Prion
•added 2020/09/11 5:15 p.m.•44 views

Security feature bypass

A security feature bypass vulnerability exists in Windows Defender Application Control WDAC which could allow an attacker to bypass WDAC enforcement. An attacker who successfully exploited this vulnerability could execute PowerShell commands that would be blocked by WDAC. To exploit the...

7.2CVSS7.9AI score0.07037EPSS
SaveExploits0References1Affected Software3
Prion
Prion
•added 2020/08/17 7:15 p.m.•44 views

Privilege escalation

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol MS-NRPC. An attacker who successfully exploited the vulnerability could run a specially crafted application on a...

9.3CVSS6.1AI score0.99512EPSS
SaveExploits75References17Affected Software10
Prion
Prion
•added 2020/07/30 9:15 p.m.•44 views

Design/Logic Flaw

The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG, aka CID-f227e3ec3b5c. This is related to drivers/char/random.c and kernel/time/timer.c...

4.3CVSS4.8AI score0.05271EPSS
SaveExploits0References15Affected Software9
Prion
Prion
•added 2020/07/14 3:15 p.m.•44 views

Denial of service

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of...

5CVSS7.2AI score0.86608EPSS
SaveExploits1References17Affected Software18
Prion
Prion
•added 2020/06/29 6:15 p.m.•44 views

Design/Logic Flaw

The web interface of Maipu MP1800X-50 7.5.3.14R devices allows remote attackers to obtain sensitive information via the form/formDeviceVerGet URI, such as system id, hardware model, hardware version, bootloader version, software version, software image file, compilation time, and system uptime...

5CVSS6.3AI score0.99876EPSS
SaveExploits21References1Affected Software1
Prion
Prion
•added 2020/06/23 10:15 p.m.•44 views

Authentication flaw

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication spark.authenticate via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even...

9.3CVSS9.5AI score0.29157EPSS
SaveExploits0References6Affected Software2
Prion
Prion
•added 2020/06/17 10:15 p.m.•44 views

Design/Logic Flaw

In ISC BIND9 versions BIND 9.11.14 - 9.11.19, BIND 9.14.9 - 9.14.12, BIND 9.16.0 - 9.16.3, BIND Supported Preview Edition 9.11.14-S1 - 9.11.19-S1: Unless a nameserver is providing authoritative service for one or more zones and at least one zone contains an empty non-terminal entry containing an...

4CVSS5.1AI score0.02105EPSS
SaveExploits0References8Affected Software5
Prion
Prion
•added 2020/04/02 12:15 a.m.•44 views

Code injection

In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with modrewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL...

5.8CVSS6.3AI score0.56691EPSS
SaveExploits0References27Affected Software12
Prion
Prion
•added 2020/02/24 10:15 p.m.•44 views

Design/Logic Flaw

In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse...

5.8CVSS7.1AI score0.09386EPSS
SaveExploits0References19Affected Software19
Prion
Prion
•added 2019/12/27 2:15 p.m.•44 views

Directory traversal

An issue was discovered in Citrix Application Delivery Controller ADC and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal...

7.5CVSS9.5AI score0.99999EPSS
SaveExploits48References10Affected Software3
Prion
Prion
•added 2019/11/25 5:15 p.m.•44 views

Heap overflow

Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in strlowercasematch in regexec.c...

5CVSS8.5AI score0.03049EPSS
SaveExploits0References5Affected Software5
Prion
Prion
•added 2019/03/05 11:29 p.m.•44 views

Remote code execution

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0604...

6.5CVSS9.5AI score0.99825EPSS
SaveExploits30References2Affected Software3
Prion
Prion
•added 2019/02/20 4:29 p.m.•44 views

Design/Logic Flaw

In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute...

4.3CVSS5.7AI score0.16404EPSS
SaveExploits2References27Affected Software16
Prion
Prion
•added 2019/01/16 7:30 p.m.•44 views

Code injection

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: PS. Supported versions that are affected are 5.6.42 and prior, 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to...

4CVSS6AI score0.02887EPSS
SaveExploits0References6Affected Software1
Prion
Prion
•added 2018/10/17 1:31 a.m.•44 views

Design/Logic Flaw

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Logging. Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise...

3.5CVSS5AI score0.02453EPSS
SaveExploits0References6Affected Software3
Prion
Prion
•added 2018/09/14 7:29 a.m.•44 views

Code injection

An issue was discovered in UCMS 1.4.6 and 1.6. It allows PHP code injection during installation via the systemdomain parameter to install/index.php, as demonstrated by injecting a phpinfo call into /inc/config.php...

7.5CVSS9.5AI score0.01658EPSS
SaveExploits1References1Affected Software1
Prion
Prion
•added 2018/07/13 8:29 p.m.•44 views

Code injection

The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property IP, as well as the management of access rights for such IP, including improperly specified HDL syntax allows use of an EDA tool as a decryption oracle. The methods are flawed and, in the most...

4.6CVSS7.4AI score0.00455EPSS
SaveExploits0References2
Prion
Prion
•added 2018/06/23 11:29 p.m.•44 views

Heap overflow

finishstab in stabs.c in GNU Binutils 2.30 allows attackers to cause a denial of service heap-based buffer overflow or possibly have unspecified other impact, as demonstrated by an out-of-bounds write of 8 bytes. This can occur during execution of objdump...

7.5CVSS8.9AI score0.04505EPSS
SaveExploits1References6Affected Software2
Prion
Prion
•added 2018/06/17 8:29 p.m.•44 views

Race condition

A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passengerinstanceregistrydir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but befor...

4.4CVSS6.9AI score0.00276EPSS
SaveExploits0References4Affected Software2
Prion
Prion
•added 2018/06/11 9:29 p.m.•44 views

Integer overflow

An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox 50...

7.5CVSS6.5AI score0.05742EPSS
SaveExploits0References6Affected Software3
Prion
Prion
•added 2018/06/04 4:29 p.m.•44 views

Remote code execution

healthcenter - IBM Monitoring and Diagnostic Tools health Center agent healthcenter downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if t...

9.3CVSS7.8AI score0.01752EPSS
SaveExploits0References1Affected Software1
Prion
Prion
•added 2018/05/24 1:29 p.m.•44 views

Design/Logic Flaw

The Linux Kernel version 3.18 contains a dangerous feature vulnerability in modifyuserhwbreakpoint that can result in crash and possibly memory corruption. This attack appear to be exploitable via local code execution and the ability to use ptrace. This vulnerability appears to have been fixed in...

4.9CVSS6.7AI score0.01221EPSS
SaveExploits0References15Affected Software10
Prion
Prion
•added 2017/12/04 8:29 a.m.•44 views

Integer overflow

The dumprelocsinsection function in objdump.c in GNU Binutils 2.29.1 does not check for reloc count integer overflows, which allows remote attackers to cause a denial of service excessive memory allocation, or heap-based buffer overflow and application crash or possibly have unspecified other...

6.8CVSS8AI score0.01885EPSS
SaveExploits1References3Affected Software1
Prion
Prion
•added 2017/07/11 9:29 p.m.•44 views

Memory corruption

Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render when handling objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique...

7.6CVSS7.7AI score0.66911EPSS
SaveExploits9References3
Prion
Prion
•added 2017/01/13 9:59 a.m.•44 views

Design/Logic Flaw

An issue was discovered on BLU Advance 5.0 and BLU R1 HD devices with Shanghai Adups software. The com.adups.fota.sysoper app is installed as a system app and cannot be disabled by the user. In the com.adups.fota.sysoper app's AndroidManifest.xml file, it sets the android:sharedUserId attribute t...

7.2CVSS7.7AI score0.00381EPSS
SaveExploits0References3
Prion
Prion
•added 2016/12/30 7:59 p.m.•44 views

Command injection

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " backslash double quote in a crafted Sender property...

7.5CVSS9.7AI score0.99714EPSS
SaveExploits60References21Affected Software3
Prion
Prion
•added 2016/12/13 9:59 p.m.•44 views

Race condition

Race condition in Oracle MySQL before 5.5.52, 5.6.x before 5.6.33, 5.7.x before 5.7.15, and 8.x before 8.0.1; MariaDB before 5.5.52, 10.0.x before 10.0.28, and 10.1.x before 10.1.18; Percona Server before 5.5.51-38.2, 5.6.x before 5.6.32-78-1, and 5.7.x before 5.7.14-8; and Percona XtraDB Cluster...

4.4CVSS6.2AI score0.04313EPSS
SaveExploits18References24Affected Software4
Prion
Prion
•added 2016/07/19 2:0 a.m.•44 views

Design/Logic Flaw

The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary...

6.8CVSS8.9AI score0.55724EPSS
SaveExploits0References54Affected Software20
Prion
Prion
•added 2016/03/02 11:59 a.m.•44 views

Sql injection

The getclientmasterkey function in s2srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a accepts a nonzero CLIENT-MASTER-KEY CLEAR-KEY-LENGTH value for an arbitrary cipher, which allows man-in-the-middle attackers to...

4.3CVSS6AI score0.82112EPSS
SaveExploits2References31Affected Software1
Prion
Prion
•added 2015/03/09 12:59 a.m.•44 views

Design/Logic Flaw

Use-after-free vulnerability in Blink, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging incorrect ordering of operations in the Web SQL Database thread relative to Blink's main thread, relate...

7.5CVSS8.1AI score0.02565EPSS
SaveExploits0References8Affected Software1
Total number of security vulnerabilities5000