Lucene search
+L
Vulncheck KevMost viewed

5118 matches found

VulnCheck KEV
VulnCheck KEV
•added 2022/01/12 12:00 a.m.•6 views

VulnCheck KEV: CVE-2020-13756

Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors or getSelectorsBySpecificity is called with input from an attacker...

9.8CVSS7.8AI score0.55084EPSS
SaveExploits4References1
VulnCheck KEV
VulnCheck KEV
•added 2022/01/06 12:00 a.m.•6 views

VulnCheck KEV: CVE-2022-22706

Arm Mali GPU Kernel Driver contains an unspecified vulnerability that allows a non-privileged user to achieve write access to read-only memory pages...

7.8CVSS7.3AI score0.01095EPSS
SaveExploits1References1
VulnCheck KEV
VulnCheck KEV
•added 2021/12/21 12:00 a.m.•6 views

VulnCheck KEV: CVE-2021-33357

A vulnerability exists in RaspAP 2.6 to 2.6.5 in the "iface" GET parameter in /ajax/networking/getnetcfg.php, when the "iface" parameter value contains special characters such as ";" which enables an unauthenticated attacker to execute arbitrary OS commands...

9.8CVSS7.5AI score0.17446EPSS
SaveExploits1References1
VulnCheck KEV
VulnCheck KEV
•added 2021/12/21 12:00 a.m.•6 views

VulnCheck KEV: CVE-2021-24499

The Workreap WordPress theme before 2.2.2 AJAX actions workreapawardtempfileuploader and workreaptempfileuploader did not perform nonce checks, or validate that the request is from a valid user in any other way. The endpoints allowed for uploading arbitrary files to the...

9.8CVSS7.4AI score0.60113EPSS
SaveExploits9References1
VulnCheck KEV
VulnCheck KEV
•added 2021/12/15 12:00 a.m.•6 views

VulnCheck KEV: CVE-2010-2743

The kernel-mode drivers in Microsoft Windows XP SP3 do not properly perform indexing of a function-pointer table during the loading of keyboard layouts from disk, which allows local users to gain privileges via a crafted application, as demonstrated in the wild in July 2010 by the Stuxnet worm,...

7.2CVSS5.8AI score0.14849EPSS
SaveExploits7References1
VulnCheck KEV
VulnCheck KEV
•added 2021/12/13 12:00 a.m.•6 views

VulnCheck KEV: CVE-2017-15303

In CPUID CPU-Z before 1.43, there is an arbitrary memory write that results directly in elevation of privileges, because any program running on the local machine while CPU-Z is running can issue an ioctl 0x9C402430 call to the kernel-mode driver e.g., cpuz141x64.sys for version 1.41...

7.8CVSS7.2AI score0.01533EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
•added 2021/12/09 12:00 a.m.•6 views

VulnCheck KEV: CVE-2021-4102

Google Chromium V8 Engine contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft...

8.8CVSS7.5AI score0.07836EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
•added 2021/12/06 12:00 a.m.•6 views

VulnCheck KEV: CVE-2021-36260

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation...

9.8CVSS7.3AI score0.99869EPSS
SaveExploits24References1
VulnCheck KEV
VulnCheck KEV
•added 2021/12/01 12:00 a.m.•6 views

VulnCheck KEV: CVE-2021-44077

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution...

9.8CVSS8AI score0.93298EPSS
SaveExploits6References1
VulnCheck KEV
VulnCheck KEV
•added 2021/11/29 12:00 a.m.•6 views

VulnCheck KEV: CVE-2021-24969

The WordPress Download Manager WordPress plugin before 3.2.22 does not sanitise and escape Template data before outputting it in various pages such as admin dashboard and frontend. Due to the lack of authorisation and CSRF checks in the wpdmsavetemplate AJAX action, any authenticated users...

5.4CVSS6AI score0.006EPSS
SaveExploits2References1
VulnCheck KEV
VulnCheck KEV
•added 2021/11/16 12:00 a.m.•6 views

VulnCheck KEV: CVE-2021-24981

The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in the wp-content/plugins directory...

7.5CVSS7.2AI score0.00811EPSS
SaveExploits2References1
VulnCheck KEV
VulnCheck KEV
•added 2021/11/15 12:00 a.m.•6 views

VulnCheck KEV: CVE-2021-24946

The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mecloadsinglepage AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue...

9.8CVSS7.4AI score0.728EPSS
SaveExploits7References1
VulnCheck KEV
VulnCheck KEV
•added 2021/11/11 12:00 a.m.•6 views

VulnCheck KEV: CVE-2020-9377

D-Link DIR-610 devices allow remote code execution via the cmd parameter to command.php...

8.8CVSS7.8AI score0.21338EPSS
SaveExploits1References1
VulnCheck KEV
VulnCheck KEV
•added 2021/11/11 12:00 a.m.•6 views

VulnCheck KEV: CVE-2017-18368

Zyxel P660HN-T1A routers contain a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user and exploited via the remotehost parameter of the ViewLog.asp page...

10CVSS7.5AI score0.94425EPSS
SaveExploits2References1
VulnCheck KEV
VulnCheck KEV
•added 2021/11/06 12:00 a.m.•6 views

VulnCheck KEV: CVE-2021-1048

Android kernel contains a use-after-free vulnerability that allows for privilege escalation...

7.8CVSS6.9AI score0.00776EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
•added 2021/11/03 12:00 a.m.•6 views

VulnCheck KEV: CVE-2019-18988

TeamViewer Desktop allows for bypass of remote-login access control because the same AES key is used for different customers' installations. If an attacker were to know this key, they could decrypt protected information stored in registry or configuration files or decryption of the Unattended...

7CVSS7.1AI score0.04707EPSS
SaveExploits2References1
VulnCheck KEV
VulnCheck KEV
•added 2021/11/03 12:00 a.m.•6 views

VulnCheck KEV: CVE-2020-8657

EyesOfNetwork contains a use of hard-coded credentials vulnerability, as it uses the same API key by default. Exploitation allows an attacker to calculate or guess the admin access token...

9.8CVSS7.3AI score0.91874EPSS
SaveExploits4References1
VulnCheck KEV
VulnCheck KEV
•added 2021/11/03 12:00 a.m.•6 views

VulnCheck KEV: CVE-2020-5847

Unraid contains a vulnerability due to the insecure use of the extract PHP function that can be abused to execute remote code as root. This CVE is chainable with CVE-2020-5849 for initial access...

10CVSS7.5AI score0.95844EPSS
SaveExploits9References1
VulnCheck KEV
VulnCheck KEV
•added 2021/11/03 12:00 a.m.•6 views

VulnCheck KEV: CVE-2019-15949

Nagios XI contains a remote code execution vulnerability in which a user can modify the checkplugin executable and insert malicious commands to execute as root...

9CVSS7.9AI score0.77039EPSS
SaveExploits13References1
VulnCheck KEV
VulnCheck KEV
•added 2021/11/03 12:00 a.m.•6 views

VulnCheck KEV: CVE-2020-14883

Oracle WebLogic Server contains an unspecified vulnerability in the Console component with high impacts to confidentilaity, integrity, and availability...

9CVSS7.3AI score0.97929EPSS
SaveExploits8References1
VulnCheck KEV
VulnCheck KEV
•added 2021/11/03 12:00 a.m.•6 views

VulnCheck KEV: CVE-2020-3452

Cisco Adaptive Security Appliance ASA and Firepower Threat Defense FTD contain an improper input validation vulnerability when HTTP requests process URLs. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an...

7.5CVSS7.3AI score0.99992EPSS
SaveExploits25References1
VulnCheck KEV
VulnCheck KEV
•added 2021/11/03 12:00 a.m.•6 views

VulnCheck KEV: CVE-2020-4428

IBM Data Risk Manager contains an unspecified vulnerability which could allow a remote, authenticated attacker to execute commands on the system.�...

9.1CVSS7.4AI score0.61692EPSS
SaveExploits8References1
VulnCheck KEV
VulnCheck KEV
•added 2021/11/03 12:00 a.m.•6 views

VulnCheck KEV: CVE-2020-10221

rConfig lib/ajaxHandlers/ajaxAddTemplate.php contains an OS command injection vulnerability that allows remote attackers to execute OS commands via shell metacharacters in the fileName POST parameter...

9CVSS7.5AI score0.36754EPSS
SaveExploits5References1
VulnCheck KEV
VulnCheck KEV
•added 2021/11/03 12:00 a.m.•6 views

VulnCheck KEV: CVE-2019-4716

IBM Planning Analytics is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting...

10CVSS7.2AI score0.86441EPSS
SaveExploits6References1
VulnCheck KEV
VulnCheck KEV
•added 2021/11/03 12:00 a.m.•6 views

VulnCheck KEV: CVE-2020-4430

IBM Data Risk Manager contains a directory traversal vulnerability that could allow a remote authenticated attacker to traverse directories and send a specially crafted URL request to download arbitrary files from the system...

4.3CVSS6.3AI score0.68544EPSS
SaveExploits6References1
VulnCheck KEV
VulnCheck KEV
•added 2021/11/03 12:00 a.m.•6 views

VulnCheck KEV: CVE-2020-17144

Microsoft Exchange Server improperly validates cmdlet arguments which allow an attacker to perform remote code execution...

8.8CVSS7.7AI score0.36514EPSS
SaveExploits4References1
VulnCheck KEV
VulnCheck KEV
•added 2021/11/03 12:00 a.m.•6 views

VulnCheck KEV: CVE-2019-20085

TVT devices utilizing NVMS-1000 software contain a directory traversal vulnerability via GET /.. requests...

7.5CVSS7.1AI score0.96071EPSS
SaveExploits6References1
VulnCheck KEV
VulnCheck KEV
•added 2021/11/03 12:00 a.m.•6 views

VulnCheck KEV: CVE-2020-5849

Unraid contains an authentication bypass vulnerability that allows attackers to gain access to the administrative interface. This CVE is chainable with CVE-2020-5847 for remote code execution...

10CVSS7.4AI score0.95844EPSS
SaveExploits9References1
VulnCheck KEV
VulnCheck KEV
•added 2021/11/03 12:00 a.m.•6 views

VulnCheck KEV: CVE-2020-10199

Sonatype Nexus Repository contains an unspecified vulnerability that allows for remote code execution...

9CVSS7.5AI score0.99064EPSS
SaveExploits10References1
VulnCheck KEV
VulnCheck KEV
•added 2021/11/03 12:00 a.m.•6 views

VulnCheck KEV: CVE-2020-3161

Cisco IP Phones contain an improper input validation vulnerability for HTTP requests. Exploitation could allow an attacker to execute code remotely with root privileges or cause a denial-of-service DoS condition...

10CVSS7.4AI score0.83734EPSS
SaveExploits4References1
VulnCheck KEV
VulnCheck KEV
•added 2021/10/28 12:00 a.m.•6 views

VulnCheck KEV: CVE-2020-0069

Multiple MediaTek chipsets contain an insufficient input validation vulnerability and have missing SELinux restrictions in the Command Queue drivers ioctl handlers. This causes an out-of-bounds write leading to privilege escalation. This vulnerability was observed chained with CVE-2019-2215 and...

7.8CVSS7.3AI score0.43823EPSS
SaveExploits31References1
VulnCheck KEV
VulnCheck KEV
•added 2021/10/11 12:00 a.m.•6 views

VulnCheck KEV: CVE-2021-1789

A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution...

8.8CVSS7.7AI score0.1322EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
•added 2021/10/11 12:00 a.m.•6 views

VulnCheck KEV: CVE-2021-30896

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 15.0.2 and iPadOS 15.0.2, tvOS 15.1, watchOS 8.1, macOS Monterey 12.0.1. A malicious application may be able to read user's gameplay data...

5.5CVSS6AI score0.00884EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
•added 2021/09/21 12:00 a.m.•6 views

VulnCheck KEV: CVE-2021-37976

Google Chromium contains an information disclosure vulnerability within the core memory component that allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium,...

6.5CVSS7.1AI score0.19748EPSS
SaveExploits1References1
VulnCheck KEV
VulnCheck KEV
•added 2021/09/21 12:00 a.m.•6 views

VulnCheck KEV: CVE-2009-3960

Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability that allows for information disclosure...

6.5CVSS7.1AI score0.90012EPSS
SaveExploits13References1
VulnCheck KEV
VulnCheck KEV
•added 2021/09/20 12:00 a.m.•6 views

VulnCheck KEV: CVE-2014-3206

Seagate BlackArmor NAS allows remote attackers to execute arbitrary code via the session parameter to localhost/backupmgt/localJob.php or the authname parameter to localhost/backupmgmt/preconnectcheck.php...

10CVSS7.7AI score0.51014EPSS
SaveExploits1References1
VulnCheck KEV
VulnCheck KEV
•added 2021/09/16 12:00 a.m.•6 views

VulnCheck KEV: CVE-2021-40539

Zoho ManageEngine ADSelfService Plus contains an authentication bypass vulnerability affecting the REST API URLs which allow for remote code execution...

9.8CVSS7.7AI score0.9896EPSS
SaveExploits8References1
VulnCheck KEV
VulnCheck KEV
•added 2021/09/15 12:00 a.m.•6 views

VulnCheck KEV: CVE-2021-38000

Google Chromium Intents contains an improper input validation vulnerability that allows a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome,...

6.1CVSS7.1AI score0.04653EPSS
SaveExploits1References1
VulnCheck KEV
VulnCheck KEV
•added 2021/09/13 12:00 a.m.•6 views

VulnCheck KEV: CVE-2021-31010

In affected versions of Apple iOS, macOS, and watchOS, a sandboxed process may be able to circumvent sandbox restrictions...

7.5CVSS7.2AI score0.03673EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
•added 2021/09/13 12:00 a.m.•6 views

VulnCheck KEV: CVE-2021-30858

Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on...

8.8CVSS7.3AI score0.13486EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
•added 2021/09/11 12:00 a.m.•6 views

VulnCheck KEV: CVE-2020-8813

graphrealtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege...

9.3CVSS7.1AI score0.73779EPSS
SaveExploits24References1
VulnCheck KEV
VulnCheck KEV
•added 2021/09/07 12:00 a.m.•6 views

VulnCheck KEV: CVE-2021-40444

Microsoft MSHTML contains a unspecified vulnerability that allows for remote code execution...

8.8CVSS7.2AI score0.9745EPSS
SaveExploits38References1
VulnCheck KEV
VulnCheck KEV
•added 2021/09/01 12:00 a.m.•6 views

VulnCheck KEV: CVE-2013-2471

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to...

10CVSS7AI score0.14749EPSS
SaveExploits4References1
VulnCheck KEV
VulnCheck KEV
•added 2021/08/30 12:00 a.m.•6 views

VulnCheck KEV: CVE-2021-34473

Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution...

10CVSS7.6AI score0.99999EPSS
SaveExploits16References1
VulnCheck KEV
VulnCheck KEV
•added 2021/08/30 12:00 a.m.•6 views

VulnCheck KEV: CVE-2021-34523

Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation...

9.8CVSS7.3AI score0.9999EPSS
SaveExploits10References1
VulnCheck KEV
VulnCheck KEV
•added 2021/08/24 12:00 a.m.•6 views

VulnCheck KEV: CVE-2021-36942

Microsoft Windows Local Security Authority LSA contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM...

7.5CVSS7AI score0.66023EPSS
SaveExploits4References1
VulnCheck KEV
VulnCheck KEV
•added 2021/08/19 12:00 a.m.•6 views

VulnCheck KEV: CVE-2019-1108

An information disclosure vulnerability exists when the Windows RDP client improperly discloses the contents of its memory, aka 'Remote Desktop Protocol Client Information Disclosure Vulnerability'...

6.5CVSS6.9AI score0.10713EPSS
SaveExploits1References1
VulnCheck KEV
VulnCheck KEV
•added 2021/08/17 12:00 a.m.•6 views

VulnCheck KEV: CVE-2018-8114

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 11. This CVE ID is unique from CVE-2018-0945, CVE-2018-0946, CVE-2018-0951,...

7.6CVSS7.7AI score0.5142EPSS
SaveExploits2References1
VulnCheck KEV
VulnCheck KEV
•added 2021/08/17 12:00 a.m.•6 views

VulnCheck KEV: CVE-2017-8605

Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render when handling objects in memory in Microsoft Edge, aka "Scripting Engine Memory...

7.6CVSS7.5AI score0.08967EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
•added 2021/08/17 12:00 a.m.•6 views

VulnCheck KEV: CVE-2010-3336

Microsoft Office XP SP3, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via a crafted Office document that triggers memory corruption, aka "MSO Large SPID Read AV Vulnerability."...

9.3CVSS6.2AI score0.23915EPSS
SaveExploits0References1
Total number of security vulnerabilities5000