Lucene search
+L
PrionMost viewed

213680 matches found

Prion
Prion
•added 2021/03/31 6:15 p.m.•37 views

Arbitrary file deletion

Arbitrary file write vulnerability in vRealize Operations Manager API CVE-2021-21983 prior to 8.4 may allow an authenticated malicious actor with network access to the vRealize Operations Manager API can write files to arbitrary locations on the underlying photon operating system...

8.5CVSS6.8AI score0.68557EPSS
SaveExploits9References2Affected Software3
Prion
Prion
•added 2021/03/23 9:15 p.m.•37 views

Out-of-bounds

The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This flaw allows a malicious privileged guest to crash the QEMU process on the host, resultin...

4.6CVSS5.7AI score0.00638EPSS
SaveExploits1References5Affected Software4
Prion
Prion
•added 2021/03/23 5:15 p.m.•37 views

Design/Logic Flaw

A flaw was found in SQLite's SELECT query functionality src/select.c. This flaw allows an attacker who is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible code execution by triggering a use-after-free. The highest threat from this vulnerabilit...

2.1CVSS5.9AI score0.00496EPSS
SaveExploits0References8Affected Software7
Prion
Prion
•added 2021/03/18 2:15 p.m.•37 views

Security feature bypass

Zoom through 5.5.4 sometimes allows attackers to read private information on a participant's screen, even though the participant never attempted to share the private part of their screen. When a user shares a specific application window via the Share Screen functionality, other meeting participan...

4.3CVSS4.6AI score0.16289EPSS
SaveExploits2References7Affected Software1
Prion
Prion
•added 2021/03/11 4:15 p.m.•37 views

Memory corruption

Internet Explorer Memory Corruption Vulnerability...

5.1CVSS7.6AI score0.80667EPSS
SaveExploits0References1Affected Software1
Prion
Prion
•added 2021/03/10 4:15 p.m.•37 views

Design/Logic Flaw

In bindServiceLocked of ActiveServices.java, there is a possible foreground service launch due to a confused deputy. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android...

4.6CVSS7.6AI score0.00127EPSS
SaveExploits0References1Affected Software1
Prion
Prion
•added 2021/03/03 5:15 p.m.•37 views

Design/Logic Flaw

A flaw was found in grub2 in versions prior to 2.06. Variable names present are expanded in the supplied command line into their corresponding variable contents, using a 1kB stack buffer for temporary storage, without sufficient bounds checking. If the function is called with a command line that...

7.2CVSS7.1AI score0.00573EPSS
SaveExploits0References4Affected Software7
Prion
Prion
•added 2021/02/26 3:15 a.m.•37 views

Design/Logic Flaw

Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. This vulnerability affects Firefox 85...

4.3CVSS7.1AI score0.01323EPSS
SaveExploits0References8Affected Software2
Prion
Prion
•added 2021/02/24 5:15 p.m.•37 views

Heap overflow

OpenSLP as used in ESXi 7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG has a heap-overflow vulnerability. A malicious actor residing within the same network segment as ESXi who has access to port 427 may be able to trigger the heap-overflow issue i...

5.8CVSS8.8AI score0.45063EPSS
SaveExploits7References3Affected Software2
Prion
Prion
•added 2021/02/10 8:15 p.m.•37 views

Cross site request forgery (csrf)

A denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability...

5CVSS7.3AI score0.03023EPSS
SaveExploits1References4Affected Software2
Prion
Prion
•added 2021/02/10 8:15 p.m.•37 views

Remote code execution

A code execution vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to remote code execution. An attacker can send an HTTP request to trigger this vulnerability...

7.5CVSS9.7AI score0.0586EPSS
SaveExploits1References4Affected Software2
Prion
Prion
•added 2021/02/04 6:15 a.m.•37 views

Sql injection

A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information. This vulnerability impacts SMA100 build version 10.x...

7.5CVSS9.8AI score0.36952EPSS
SaveExploits0References1Affected Software1
Prion
Prion
•added 2021/02/02 6:15 p.m.•37 views

Design/Logic Flaw

In the rcp client in MIT krb5-appl through 1.0.3, malicious servers could bypass intended access restrictions via the filename of . or an empty filename, similar to CVE-2018-20685 and CVE-2019-7282. The impact is modifying the permissions of the target directory on the client side. NOTE: MIT...

5CVSS6.1AI score0.03681EPSS
SaveExploits2References1Affected Software1
Prion
Prion
•added 2021/01/29 5:15 p.m.•37 views

Design/Logic Flaw

An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault handling, allowing local users to execute code in the kernel, aka CID-34b1a1ce1458...

7.2CVSS7.3AI score0.01377EPSS
SaveExploits1References19Affected Software3
Prion
Prion
•added 2021/01/20 8:15 p.m.•37 views

Cross site request forgery (csrf)

A vulnerability in the web-based management interface of Cisco DNA Center Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack to manipulate an authenticated user into executing malicious actions without their awareness or consent. The...

6.8CVSS8.8AI score0.00836EPSS
SaveExploits0References2Affected Software2
Prion
Prion
•added 2021/01/11 10:15 p.m.•37 views

Out-of-bounds

In avrcparsvendorcmd of avrcparstg.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions:...

10CVSS9.2AI score0.03057EPSS
SaveExploits0References1Affected Software1
Prion
Prion
•added 2020/12/29 10:15 p.m.•37 views

Authentication flaw

The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise of the SolarWinds instance. SolarWinds...

7.5CVSS9.8AI score0.9198EPSS
SaveExploits3References2Affected Software1
Prion
Prion
•added 2020/12/14 8:15 p.m.•37 views

Code injection

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service...

4.3CVSS5.5AI score0.03851EPSS
SaveExploits0References16Affected Software16
Prion
Prion
•added 2020/12/07 8:15 p.m.•37 views

Format string

In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501...

7.5CVSS7AI score0.04352EPSS
SaveExploits1References4Affected Software3
Prion
Prion
•added 2020/10/30 5:15 p.m.•37 views

Design/Logic Flaw

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widgettabbedcontainertabpanel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759. ALSO NOTE: CVE-2020-7373 is a duplicate of CVE-2020-17496. CVE-2020-17496 is...

7.5CVSS9.7AI score0.99728EPSS
SaveExploits30References4Affected Software1
Prion
Prion
•added 2020/10/21 3:15 p.m.•37 views

Code injection

Vulnerability in the Oracle Solaris product of Oracle Systems component: Pluggable authentication module. Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Solaris...

10CVSS9.4AI score0.79842EPSS
SaveExploits13References6Affected Software1
Prion
Prion
•added 2020/09/04 3:15 a.m.•37 views

Design/Logic Flaw

A vulnerability in the application protocol handling features of Cisco Jabber for Windows could allow an unauthenticated, remote attacker to execute arbitrary commands. The vulnerability is due to improper handling of input to the application protocol handlers. An attacker could exploit this...

9.3CVSS9AI score0.03902EPSS
SaveExploits0References1Affected Software1
Prion
Prion
•added 2020/08/17 7:15 p.m.•37 views

Remote code execution

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully...

7.6CVSS8.4AI score0.24188EPSS
SaveExploits0References2Affected Software1
Prion
Prion
•added 2020/08/17 7:15 p.m.•37 views

Remote code execution

A remote code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or...

6.8CVSS6.7AI score0.04926EPSS
SaveExploits0References1Affected Software1
Prion
Prion
•added 2020/08/13 3:15 a.m.•37 views

Buffer overflow

A buffer overflow vulnerability in epscprintpage in devices/gdevepsc.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51...

4.3CVSS5.9AI score0.0187EPSS
SaveExploits1References6Affected Software3
Prion
Prion
•added 2020/08/06 4:15 p.m.•37 views

Sql injection

CAYIN xPost suffers from an unauthenticated SQL Injection vulnerability. Input passed via the GET parameter 'wayfinderseqid' in wayfindermeetinginput.jsp is not properly sanitized before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injectin...

10CVSS9.9AI score0.14014EPSS
SaveExploits5References2Affected Software1
Prion
Prion
•added 2020/07/29 4:15 p.m.•37 views

Cross site request forgery (csrf)

TeamViewer Desktop for Windows before 15.8.3 does not properly quote its custom URI handlers. A malicious website could launch TeamViewer with arbitrary parameters, as demonstrated by a teamviewer10: --play URL. An attacker could force a victim to send an NTLM authentication request and either...

6.8CVSS8.8AI score0.25895EPSS
SaveExploits2References2Affected Software1
Prion
Prion
•added 2020/07/14 11:15 p.m.•37 views

Privilege escalation

An elevation of privilege vulnerability exists when Microsoft SharePoint Server and Skype for Business Server improperly handle OAuth token validation. An attacker who successfully exploited the vulnerability could bypass authentication and achieve improper access. To exploit this vulnerability, ...

7.5CVSS9.4AI score0.05853EPSS
SaveExploits0References1Affected Software5
Prion
Prion
•added 2020/07/13 1:15 p.m.•37 views

Input validation

In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because procpax lacks header validation...

5CVSS7.4AI score0.06253EPSS
SaveExploits0References27Affected Software7
Prion
Prion
•added 2020/07/10 4:15 p.m.•37 views

Code injection

Reflected code injection in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows the modification of a file download...

4.3CVSS6.8AI score0.10695EPSS
SaveExploits0References1Affected Software4
Prion
Prion
•added 2020/07/09 6:15 p.m.•37 views

Design/Logic Flaw

In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the HTTP response headers is released back to the ByteBufferPool twice. Because of this doub...

7.5CVSS9.1AI score0.11138EPSS
SaveExploits0References17Affected Software1
Prion
Prion
•added 2020/06/15 6:15 p.m.•37 views

Integer overflow

An integer overflow in the getnum function in luastruct.c in Redis before 6.0.3 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service memory corruption and application crash or possibly bypass intended sandbox restrictions via a large...

4CVSS7.9AI score0.04576EPSS
SaveExploits1References6Affected Software4
Prion
Prion
•added 2020/06/04 1:15 p.m.•37 views

Design/Logic Flaw

ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service daemon exit or system time change by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path...

5.8CVSS7.2AI score0.04071EPSS
SaveExploits0References7Affected Software8
Prion
Prion
•added 2020/05/08 2:15 p.m.•37 views

Race condition

The fix for CVE-2019-11599, affecting the Linux kernel before 5.0.10 was not complete. A local user could use this flaw to obtain sensitive information, cause a denial of service, or possibly have other unspecified impacts by triggering a race condition with mmgetnotzero or gettaskmm calls...

6.9CVSS7.5AI score0.00989EPSS
SaveExploits5References7Affected Software2
Prion
Prion
•added 2020/05/01 4:15 p.m.•37 views

Command injection

An OS Command Injection vulnerability in the endpointdevicemap.php component of Fonality Trixbox Community Edition allows an attacker to execute commands on the underlying operating system as the "asterisk" user. Note that Trixbox Community Edition has been unsupported by the vendor since 2012...

9CVSS9AI score0.65208EPSS
SaveExploits4References2Affected Software1
Prion
Prion
•added 2020/04/30 5:15 p.m.•37 views

Authentication flaw

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the...

7.5CVSS8.5AI score0.96614EPSS
SaveExploits24References11Affected Software5
Prion
Prion
•added 2020/04/28 3:15 p.m.•37 views

Remote code execution

A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a...

7.5CVSS9.6AI score0.9927EPSS
SaveExploits48References5Affected Software1
Prion
Prion
•added 2020/04/27 1:15 p.m.•37 views

Cross site scripting

Grafana version 6.7.3 is vulnerable for annotation popup XSS...

4.3CVSS6.3AI score0.0148EPSS
SaveExploits0References2Affected Software1
Prion
Prion
•added 2020/04/21 7:15 p.m.•37 views

Directory traversal

Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is similar to CVE-2020-5260GHSA-qm7j-c969-7j4q. The fix for that bug still left the door open for an exploit where some credential is leaked but...

5CVSS7.5AI score0.10047EPSS
SaveExploits2References12Affected Software4
Prion
Prion
•added 2020/04/16 7:15 p.m.•37 views

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-11612. Reason: This candidate is a reservation duplicate of CVE-2020-11612. Notes: All CVE users should reference CVE-2020-11612 instead of this candidate. All references and descriptions in this candidate have been removed t...

7.4AI score0.09438EPSS
SaveExploits0
Prion
Prion
•added 2020/04/15 7:15 p.m.•37 views

Design/Logic Flaw

An issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to see if the request should be denied. Squid by default comes with rules to block access to the Cache Manager, which serves detailed server information meant for the maintainer. This rule is...

7.5CVSS9.2AI score0.04151EPSS
SaveExploits0References5Affected Software3
Prion
Prion
•added 2020/04/15 2:15 p.m.•37 views

Code injection

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: Privileges. Supported versions that are affected are 8.0.18 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

4CVSS4.8AI score0.02394EPSS
SaveExploits0References6Affected Software3
Prion
Prion
•added 2020/04/15 2:15 p.m.•37 views

Code injection

Vulnerability in the Oracle Solaris product of Oracle Systems component: Common Desktop Environment. Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise...

7.2CVSS8.4AI score0.01802EPSS
SaveExploits5References4Affected Software1
Prion
Prion
•added 2020/04/15 2:15 p.m.•37 views

Code injection

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Replication. Supported versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols t...

4CVSS4.8AI score0.02199EPSS
SaveExploits0References7Affected Software4
Prion
Prion
•added 2020/04/14 11:15 p.m.•37 views

Out-of-bounds

An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder::refill in ImfFastHuf.cpp...

4.3CVSS6.6AI score0.01785EPSS
SaveExploits1References16Affected Software11
Prion
Prion
•added 2020/04/04 2:15 p.m.•37 views

Remote code execution

Zoho ManageEngine ADSelfService Plus before 5815 allows unauthenticated remote code execution...

7.5CVSS9.8AI score0.1879EPSS
SaveExploits0References1Affected Software1
Prion
Prion
•added 2020/03/30 8:15 p.m.•37 views

Sql injection

The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint. A remote unauthenticated attacker can invoke the challenge action with a crafted username and discover user passwords...

5CVSS8.3AI score0.11875EPSS
SaveExploits3References1Affected Software3
Prion
Prion
•added 2020/03/12 4:15 p.m.•37 views

Privilege escalation

An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service BITS improperly handles symbolic links, aka 'Windows Background Intelligent Transfer Service Elevation of Privilege Vulnerability'...

7.2CVSS7.7AI score0.42524EPSS
SaveExploits7References2Affected Software5
Prion
Prion
•added 2020/03/02 4:15 p.m.•37 views

Cross site scripting

In Puma RubyGem before 4.3.3 and 3.12.4, if an application using Puma allows untrusted input in an early-hints header, an attacker can use a carriage return character to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is...

4CVSS6.5AI score0.02549EPSS
SaveExploits0References7Affected Software1
Prion
Prion
•added 2020/02/11 10:15 p.m.•37 views

Remote code execution

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0674, CVE-2020-0710, CVE-2020-0711, CVE-2020-0712, CVE-2020-0713,...

7.6CVSS7.7AI score0.86863EPSS
SaveExploits17References1Affected Software1
Total number of security vulnerabilities5000