Lucene search
+L
PrionMost viewed

213680 matches found

Prion
Prion
added 2024/03/12 1:15 a.m.42 views

Authentication flaw

Under certain conditions SAP NetWeaver WSRM - version 7.50, allows an attacker to access information which would otherwise be restricted, causing low impact on Confidentiality with no impact on Integrity and Availability of the application...

5CVSS7.2AI score0.0041EPSS
SaveExploits0References2
Prion
Prion
added 2024/03/11 11:15 p.m.42 views

Cross site scripting

phlex is an open source framework for building object-oriented views in Ruby. There is a potential cross-site scripting XSS vulnerability that can be exploited via maliciously crafted user data. This was due to improper case-sensitivity in the code that was meant to prevent these attacks. If you...

5.8CVSS6.4AI score0.00604EPSS
SaveExploits0References4
Prion
Prion
added 2024/03/11 8:15 p.m.42 views

Design/Logic Flaw

OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. By manually manipulating http requests when using the draw.io integration it is possible to read arbitrary files as the configured system user and SSRF. The problem is fixed in version...

4.6CVSS4.8AI score0.00431EPSS
SaveExploits0References3
Prion
Prion
added 2024/03/11 6:15 p.m.42 views

Design/Logic Flaw

In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Add alignment check for event ring read pointer Though we do check the event ring read pointer by "isvalidringptr" to make sure it is in the buffer range, but there is another risk the pointer may be not aligned...

7.3AI score0.0028EPSS
SaveExploits0References5
Prion
Prion
added 2024/03/11 4:15 p.m.42 views

Out-of-bounds

An out of bounds write due to a missing bounds check in LabVIEW may result in remote code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions...

4.3CVSS7.9AI score0.00591EPSS
SaveExploits0References1
Prion
Prion
added 2024/03/08 7:15 a.m.42 views

Design/Logic Flaw

The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the atkpcreatelist function in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with subscriber-level acce...

6.5CVSS6AI score0.00289EPSS
SaveExploits0References2
Prion
Prion
added 2024/03/06 5:15 p.m.42 views

Default credentials

In Jenkins Delphix Plugin 3.0.1, a global option for administrators to enable or disable SSL/TLS certificate validation for Data Control Tower DCT connections is disabled by default...

6.6AI score0.00417EPSS
SaveExploits0References1
Prion
Prion
added 2024/03/04 7:15 a.m.42 views

Double free

In the Linux kernel, the following vulnerability has been resolved: tomoyo: fix UAF write bug in tomoyowritecontrol Since tomoyowritecontrol updates head-writebuf when write of long lines is requested, we need to fetch head-writebuf after head-iosem is held. Otherwise, concurrent write requests c...

7.1AI score0.00238EPSS
SaveExploits0References8
Prion
Prion
added 2024/03/01 12:15 a.m.42 views

Sql injection

A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/listipAddressPolicy.php. The manipulation of the argument GroupId leads to sql injection. The attack can ...

6.5CVSS6.8AI score0.08537EPSS
SaveExploits1References3
Prion
Prion
added 2024/02/29 7:15 a.m.42 views

Server side request forgery (ssrf)

The Friends plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.8.5 via the discoveravailablefeeds function. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary...

4.7CVSS5.3AI score0.00459EPSS
SaveExploits0References3
Prion
Prion
added 2024/02/29 6:15 a.m.42 views

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Melapress WP Activity Log allows Stored XSS.This issue affects WP Activity Log: from n/a through 4.6.1...

6.8CVSS7AI score0.00331EPSS
SaveExploits0References1
Prion
Prion
added 2024/02/29 1:43 a.m.42 views

Cross site scripting

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 4.14.4 due to insufficient input sanitization...

6.4CVSS6.4AI score0.00572EPSS
SaveExploits0References3
Prion
Prion
added 2024/02/28 1:15 p.m.42 views

Sql injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in miniorange Malware Scanner.This issue affects Malware Scanner: from n/a through 4.7.2...

4.7CVSS8AI score0.00541EPSS
SaveExploits0References1
Prion
Prion
added 2024/02/28 1:15 p.m.42 views

Sql injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Skymoonlabs MoveTo.This issue affects MoveTo: from n/a through 6.2...

7.5CVSS9.8AI score0.00565EPSS
SaveExploits0References1
Prion
Prion
added 2024/02/28 9:15 a.m.42 views

Spoofing

In the Linux kernel, the following vulnerability has been resolved: media: venus: core: Fix some resource leaks in the error path of 'venusprobe' If an error occurs after a successful 'oficcget' call, it must be undone. Use 'devmoficcget' instead of 'oficcget' to avoid the leak. Update the remove...

6.6AI score0.00239EPSS
SaveExploits0References4
Prion
Prion
added 2024/02/28 9:15 a.m.42 views

Design/Logic Flaw

In the Linux kernel, the following vulnerability has been resolved: mm: memcontrol: slab: fix obtain a reference to a freeing memcg Patch series "Use objcgroup APIs to charge kmem pages", v5. Since Roman's series "The new cgroup slab memory controller" applied. All slab objects are charged with t...

6.8AI score0.00249EPSS
SaveExploits0References4
Prion
Prion
added 2024/02/28 9:15 a.m.42 views

Out-of-bounds

In the Linux kernel, the following vulnerability has been resolved: ataflop: potential out of bounds in doformat The function uses "type" as an array index: q = unitdrive.disktype-queue; Unfortunately the bounds check on "type" isn't done until later in the function. Fix this by moving the bounds...

6.7AI score0.00244EPSS
SaveExploits0References3
Prion
Prion
added 2024/02/28 9:15 a.m.42 views

Spoofing

In the Linux kernel, the following vulnerability has been resolved: mt76: mt7615: fix tx skb dma unmap The first pointer in the txp needs to be unmapped as well, otherwise it will leak DMA mapping entries...

6.7AI score0.00222EPSS
SaveExploits0References4
Prion
Prion
added 2024/02/28 12:15 a.m.42 views

Unrestricted file upload

Unrestricted Upload of File with Dangerous Type in freescout-helpdesk/freescout...

4.3CVSS7.2AI score0.00383EPSS
SaveExploits1References1
Prion
Prion
added 2024/02/26 4:28 p.m.42 views

Spoofing

In the Linux kernel, the following vulnerability has been resolved: PCI/ASPM: Fix deadlock when enabling ASPM A last minute revert in 6.7-final introduced a potential deadlock when enabling ASPM during probe of Qualcomm PCIe controllers as reported by lockdep:...

7AI score0.00208EPSS
SaveExploits0References2
Prion
Prion
added 2024/02/26 4:27 p.m.42 views

Design/Logic Flaw

Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptors, eventually causing the server to st...

5CVSS6.9AI score0.01433EPSS
SaveExploits0References2
Prion
Prion
added 2024/02/23 1:15 a.m.42 views

Buffer overflow

UNSUPPORTED WHEN ASSIGNED A vulnerability, which was classified as critical, has been found in D-Link DIR-600M C1 3.08. Affected by this issue is some unknown functionality of the component Telnet Service. The manipulation of the argument username leads to buffer overflow. The attack may be...

7.8CVSS7.3AI score0.02745EPSS
SaveExploits1References3
Prion
Prion
added 2024/02/23 1:15 a.m.42 views

Stack overflow

A vulnerability classified as critical has been found in Totolink LR1200GB 9.1.0u.6619B20230130/9.3.5u.6698B20230810. Affected is the function loginAuth of the file /cgi-bin/cstecgi.cgi of the component Web Interface. The manipulation of the argument httphost leads to stack-based buffer overflow...

10CVSS7.3AI score0.02029EPSS
SaveExploits1References3
Prion
Prion
added 2024/02/14 2:15 p.m.42 views

Buffer overflow

Improper buffer restrictions in some IntelR ThunderboltTM DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable information disclosure via local access...

1.7CVSS6.6AI score0.0021EPSS
SaveExploits0References1
Prion
Prion
added 2024/02/07 3:15 p.m.42 views

Design/Logic Flaw

Open Forms allows users create and publish smart forms. Versions prior to 2.2.9, 2.3.7, 2.4.5, and 2.5.2 contain a non-exploitable multi-factor authentication weakness. Superusers who have their credentials username + password compromised could potentially have the second-factor authentication...

3.2CVSS7.5AI score0.00599EPSS
SaveExploits0References5Affected Software1
Prion
Prion
added 2024/02/05 2:15 p.m.42 views

Command injection

An improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiSIEM version 7.1.0 through 7.1.1 and 7.0.0 through 7.0.2 and 6.7.0 through 6.7.8 and 6.6.0 through 6.6.3 and 6.5.0 through 6.5.2 and 6.4.0 through 6.4.2 allows attacker to execute...

7.5CVSS7.9AI score0.03224EPSS
SaveExploits0References1Affected Software1
Prion
Prion
added 2024/01/23 9:15 p.m.42 views

Design/Logic Flaw

An agent link vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability...

4.3CVSS7.5AI score0.00244EPSS
SaveExploits0References2Affected Software1
Prion
Prion
added 2024/01/16 10:15 p.m.42 views

Code injection

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Replication. Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL...

4.7CVSS6.4AI score0.00816EPSS
SaveExploits0References2Affected Software1
Prion
Prion
added 2024/01/16 10:15 p.m.42 views

Code injection

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: UDF. Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server...

4CVSS6.6AI score0.01104EPSS
SaveExploits0References2Affected Software1
Prion
Prion
added 2024/01/15 1:15 p.m.42 views

Input validation

Acrobat Reader T5 MSFT Edge versions 120.0.2210.91 and earlier are affected by an Improper Input Validation vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue...

1.9CVSS6.6AI score0.0072EPSS
SaveExploits0References1Affected Software2
Prion
Prion
added 2024/01/12 10:15 p.m.42 views

Authorization

A vulnerability was found in Apollo 2.0.0/2.0.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /users of the component Configuration Center. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been...

4CVSS7.1AI score0.00463EPSS
SaveExploits1References3Affected Software1
Prion
Prion
added 2024/01/05 5:15 p.m.42 views

Design/Logic Flaw

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. AMD CPUs since 2014 have extensions to normal x86 debugging functionality. Xen supports guests using these extensions. Unfortunately there are errors in Xen's handling of...

1.7CVSS5.5AI score0.02501EPSS
SaveExploits0References1Affected Software1
Prion
Prion
added 2024/01/03 11:15 p.m.42 views

Design/Logic Flaw

Amazon Ion is a Java implementation of the Ion data notation. Prior to version 1.10.5, a potential denial-of-service issue exists in ion-java for applications that use ion-java to deserialize Ion text encoded data, or deserialize Ion text or binary encoded data into the IonValue model and then...

5CVSS7.2AI score0.00827EPSS
SaveExploits0References1Affected Software1
Prion
Prion
added 2024/01/02 3:15 a.m.42 views

Out-of-bounds

In Modem IMS Call UA, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01161830; Issue ID: MOLY01161830 MSV-894...

5CVSS7.2AI score0.00948EPSS
SaveExploits0References1
Prion
Prion
added 2023/12/14 10:15 p.m.42 views

Cross site scripting

A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting XSS or further attacks. This flaw is the result of an incomple...

4.9CVSS5.9AI score0.00931EPSS
SaveExploits1References14Affected Software5
Prion
Prion
added 2023/12/12 6:15 p.m.42 views

Remote code execution

Windows MSHTML Platform Remote Code Execution Vulnerability...

5.1CVSS7.7AI score0.92817EPSS
SaveExploits0References1Affected Software11
Prion
Prion
added 2023/12/12 12:15 p.m.42 views

Information disclosure

A vulnerability has been identified in SIMATIC STEP 7 TIA Portal All versions V19. An information disclosure vulnerability could allow a local attacker to gain access to the access level password of the SIMATIC S7-1200 and S7-1500 CPUs, when entered by a legitimate user in the hardware...

1.7CVSS6.7AI score0.00142EPSS
SaveExploits0References1Affected Software1
Prion
Prion
added 2023/11/21 6:15 a.m.42 views

Code injection

The BGP daemon bgpd in IP Infusion ZebOS through 7.10.6 allow remote attackers to cause a denial of service by sending crafted BGP update messages containing a malformed attribute...

5CVSS7.2AI score0.01425EPSS
SaveExploits1References4Affected Software6
Prion
Prion
added 2023/11/14 9:15 p.m.42 views

Authentication flaw

VMware Cloud Director Appliance contains an authentication bypass vulnerability in case VMware Cloud Director Appliance was upgraded to 10.5 from an older version. On an upgraded version of VMware Cloud Director Appliance 10.5, a malicious actor with network access to the appliance can bypass log...

7.5CVSS7.9AI score0.01345EPSS
SaveExploits4References4Affected Software1
Prion
Prion
added 2023/11/02 8:15 a.m.42 views

Design/Logic Flaw

Net-NTLM leak via HTML injection in FireFlow VisualFlow workflow editor allows an attacker to obtain victim’s domain credentials and Net-NTLM hash which can lead to relay domain attacks. Fixed in A32.20 b570 or above, A32.50 b390 or above...

4.9CVSS5.7AI score0.00301EPSS
SaveExploits0References1Affected Software1
Prion
Prion
added 2023/10/30 7:15 p.m.42 views

Cross site request forgery (csrf)

baserCMS is a website development framework. Prior to version 4.8.0, there is a cross site request forgery vulnerability in the content preview feature of baserCMS. Version 4.8.0 contains a patch for this issue...

7.5CVSS9.3AI score0.00347EPSS
SaveExploits0References3Affected Software1
Prion
Prion
added 2023/10/26 9:15 p.m.42 views

Sql injection

An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands. Note: Software...

6.5CVSS8.9AI score0.04468EPSS
SaveExploits1References2Affected Software20
Prion
Prion
added 2023/10/26 6:15 p.m.42 views

Stack overflow

A flaw was discovered in Elasticsearch, affecting the search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service...

5CVSS7.2AI score0.60679EPSS
SaveExploits4References3Affected Software1
Prion
Prion
added 2023/10/25 6:17 p.m.42 views

Design/Logic Flaw

jose4j before v0.9.3 allows attackers to set a low iteration count of 1000 or less...

5CVSS7.5AI score0.00644EPSS
SaveExploits0References2Affected Software1
Prion
Prion
added 2023/10/13 1:15 p.m.42 views

Code injection

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 25.0.0 and prior to 25.09 and 26.04; as well as Nextcloud Enterprise Server starting with 22.0.0 and prior to 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4; missing...

5CVSS7.5AI score0.00575EPSS
SaveExploits0References3Affected Software1
Prion
Prion
added 2023/10/13 7:15 a.m.42 views

Sql injection

Adobe Commerce versions 2.4.7-beta1 and earlier, 2.4.6-p2 and earlier, 2.4.5-p4 and earlier and 2.4.4-p5 and earlier are affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could lead in arbitrary code execution by an admin-privileg...

4.3CVSS7.5AI score0.00829EPSS
SaveExploits0References1Affected Software2
Prion
Prion
added 2023/10/12 6:15 a.m.42 views

Design/Logic Flaw

Templates do not properly consider backticks as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, the contents of the action can be used to...

7.5CVSS9.4AI score0.0075EPSS
SaveExploits0References1Affected Software1
Prion
Prion
added 2023/10/11 4:15 p.m.42 views

Command injection

A command execution vulnerability exists in the validate.so diagpingstart functionality of Yifan YF325 v1.020221108. A specially crafted network request can lead to command execution. An attacker can send a network request to trigger this vulnerability...

7.5CVSS9.5AI score0.01212EPSS
SaveExploits0References1Affected Software1
Prion
Prion
added 2023/10/10 6:15 p.m.42 views

Remote code execution

Microsoft SQL OLE DB Remote Code Execution Vulnerability...

4.4CVSS8AI score0.00982EPSS
SaveExploits0References1Affected Software2
Prion
Prion
added 2023/09/25 8:15 p.m.42 views

Input validation

snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service DoS attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverab...

5CVSS7.3AI score0.0104EPSS
SaveExploits1References2Affected Software1
Total number of security vulnerabilities5000