5431 matches found
VulnCheck KEV: CVE-2022-32893
Apple iOS and macOS contain an out-of-bounds write vulnerability that could allow for remote code execution when processing malicious crafted web content...
VulnCheck KEV: CVE-2022-30333
RARLAB UnRAR on Linux and UNIX contains a directory traversal vulnerability, allowing an attacker to write to files during an extract unpack operation...
VulnCheck KEV: CVE-2022-31181
PrestaShop is an Open Source e-commerce platform. In versions from 1.6.0.10 and before 1.7.8.7 PrestaShop is subject to an SQL injection vulnerability which can be chained to call PHP's Eval function on attacker input. The problem is fixed in version 1.7.8.7. Users are advised to upgrade. Users...
VulnCheck KEV: CVE-2022-2856
Google Chromium Intents contains an insufficient validation of untrusted input vulnerability that allows a remote attacker to browse to a malicious website via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google...
VulnCheck KEV: CVE-2022-2294
WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows an attacker to perform shellcode execution. This vulnerability impacts web browsers using WebRTC including but not limited to Google Chrome...
VulnCheck KEV: CVE-2022-33198
Unauthenticated WordPress Options Change vulnerability in Biplob Adhikari's Accordions plugin = 2.0.2 at WordPress...
VulnCheck KEV: CVE-2021-41349
Microsoft Exchange Server Spoofing Vulnerability...
VulnCheck KEV: CVE-2021-21980
The vSphere Web Client FLEX/Flash contains an unauthorized arbitrary file read vulnerability. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information...
VulnCheck KEV: CVE-2022-30525
A command injection vulnerability in the CGI program of some Zyxel firewall versions could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device...
VulnCheck KEV: CVE-2022-0847
Linux kernel contains an improper initialization vulnerability where an unprivileged local user could escalate their privileges on the system. This vulnerability has the moniker of "Dirty Pipe."...
VulnCheck KEV: CVE-2022-1364
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge...
VulnCheck KEV: CVE-2022-24521
Microsoft Windows Common Log File System CLFS Driver contains an unspecified vulnerability that allows for privilege escalation...
VulnCheck KEV: CVE-2020-17456
SEOWON INTECH SLC-130 And SLR-120S devices allow Remote Code Execution via the ipAddr parameter to the systemlog.cgi page...
VulnCheck KEV: CVE-2022-25081
TOTOLink T10 V5.9c.5061B20200511 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERYSTRING parameter...
VulnCheck KEV: CVE-2021-26085
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a pre-authorization arbitrary file read vulnerability in the /s/ endpoint...
VulnCheck KEV: CVE-2021-34486
Microsoft Windows Event Tracing contains an unspecified vulnerability which can allow for privilege escalation...
VulnCheck KEV: CVE-2019-10068
Kentico contains a failure to validate security headers. This deserialization can led to unauthenticated remote code execution...
VulnCheck KEV: CVE-2009-2055
Cisco IOS XR,when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service DoS...
VulnCheck KEV: CVE-2014-3120
Elasticsearch enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code...
VulnCheck KEV: CVE-2019-1130
A privilege escalation vulnerability exists when Windows AppX Deployment Service AppXSVC improperly handles hard links...
VulnCheck KEV: CVE-2019-1388
An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka 'Windows Certificate Dialog Elevation of Privilege Vulnerability'...
VulnCheck KEV: CVE-2022-26143
A vulnerability has been identified in MiCollab and MiVoice Business Express that may allow a malicious actor to gain unauthorized access to sensitive information and services, cause performance degradations or a denial of service condition on the affected system...
VulnCheck KEV: CVE-2021-22600
Linux Kernel contains a flaw in the packet socket AFPACKET implementation which could lead to incorrectly freeing memory. A local user could exploit this for denial-of-service DoS or possibly for privilege escalation...
VulnCheck KEV: CVE-2022-26134
Atlassian Confluence Server and Data Center contain a remote code execution vulnerability that allows for an unauthenticated attacker to perform remote code execution...
VulnCheck KEV: CVE-2022-26486
Mozilla Firefox contains a use-after-free vulnerability in WebGPU IPC Framework which can be exploited to perform arbitrary code execution...
VulnCheck KEV: CVE-2017-6737
The Simple Network Management Protocol SNMP subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code...
VulnCheck KEV: CVE-2017-12234
There is a vulnerability in the implementation of the Common Industrial Protocol CIP feature in Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service...
VulnCheck KEV: CVE-2014-0496
Adobe Reader and Acrobat contain a use-after-free vulnerability which can allow for code execution...
VulnCheck KEV: CVE-2017-12240
The Dynamic Host Configuration Protocol DHCP relay subsystem of Cisco IOS and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code and gain full control of an affected system...
VulnCheck KEV: CVE-2022-23134
Malicious actors can pass step checks and potentially change the configuration of Zabbix Frontend...
VulnCheck KEV: CVE-2022-23131
Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML...
VulnCheck KEV: CVE-2020-11984
Apache HTTP server 2.4.32 to 2.4.44 modproxyuwsgi info disclosure and possible RCE...
VulnCheck KEV: CVE-2022-0429
The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 8.9.6 does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboard, leading to an unauthenticated stored Cross-Site Scripting vulnerability...
VulnCheck KEV: CVE-2022-24086
Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution...
VulnCheck KEV: CVE-2018-19943
A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code...
VulnCheck KEV: CVE-2018-1000001
In glibc 2.26 and earlier there is confusion in the usage of getcwd by realpath which can be used to write before the destination buffer leading to a buffer underflow and potential code execution...
VulnCheck KEV: CVE-2022-0288
The Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro WordPress plugin before 2.7.10 do not sanitise and escape the htmlelementselection parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting...
VulnCheck KEV: CVE-2020-14864
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware component: Installation. Supported versions that are affected are 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via...
VulnCheck KEV: CVE-2021-31206
Microsoft Exchange Server Remote Code Execution Vulnerability...
VulnCheck KEV: CVE-2020-10828
A stack-based buffer overflow in cvmd on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request...
VulnCheck KEV: CVE-2013-6720
Directory traversal vulnerability in download.php in the Passive Capture Application PCA web console in IBM Tealeaf CX 7.x, 8.x through 8.6, 8.7 before FP2, and 8.8 before FP2 allows remote authenticated users to bypass intended access restrictions via a .. dot dot in the log parameter, as...
VulnCheck KEV: CVE-2020-13756
Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors or getSelectorsBySpecificity is called with input from an attacker...
VulnCheck KEV: CVE-2021-33357
A vulnerability exists in RaspAP 2.6 to 2.6.5 in the "iface" GET parameter in /ajax/networking/getnetcfg.php, when the "iface" parameter value contains special characters such as ";" which enables an unauthenticated attacker to execute arbitrary OS commands...
VulnCheck KEV: CVE-2021-40870
An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal...
VulnCheck KEV: CVE-2021-33766
Microsoft Exchange Server Information Disclosure Vulnerability...
VulnCheck KEV: CVE-2021-44515
Zoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server...
VulnCheck KEV: CVE-2021-37415
Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication...
VulnCheck KEV: CVE-2021-41379
Microsoft Windows Installer contains an unspecified vulnerability that allows for privilege escalation...
VulnCheck KEV: CVE-2021-39317
A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the pluginofflineinstaller AJAX action due to a missing capability check in the pluginofflineinstallercallback function found in the /demo-functions.php file or /welcome.ph...