5119 matches found
VulnCheck KEV: CVE-2019-17270
Yachtcontrol through 2019-10-06: It's possible to perform direct Operating System commands as an unauthenticated user via the "/pages/systemcall.php?command=COMMAND" page and parameter, where COMMAND will be executed and returning the results to the client. Affects Yachtcontrol webservers...
VulnCheck KEV: CVE-2019-19985
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure...
VulnCheck KEV: CVE-2019-1579
Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled...
VulnCheck KEV: CVE-2019-16057
The loginmgr.cgi script in D-Link DNS-320 is vulnerable to remote code execution...
VulnCheck KEV: CVE-2019-0880
A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls. An attacker who successfully exploited the vulnerability could elevate privileges on an affected system from low-integrity to medium-integrity...
VulnCheck KEV: CVE-2018-18852
Cerio DT-300N 1.1.6 through 1.1.12 devices allow OS command injection because of improper input validation of the web-interface PING feature's use of Save.cgi to execute a ping command, as exploited in the wild in October 2018...
VulnCheck KEV: CVE-2018-20841
HooToo TripMate Titan HT-TM05 and HT-05 routers with firmware 2.000.022 and 2.000.082 allow remote command execution via shell metacharacters in the mac parameter of a protocol.csp?function=set&fname=security&opt=mactable request...
VulnCheck KEV: CVE-2013-5758
cgi-bin/cgiServer.exx in Yealink VoIP Phone SIP-T38G allows remote authenticated users to execute arbitrary commands by calling the system method in the body of a request, as demonstrated by running unauthorized services, changing directory permissions, and modifying files...
VulnCheck KEV: CVE-2009-2765
httpd.c in httpd in the management GUI in DD-WRT 24 sp1, and other versions before build 12533, allows remote attackers to execute arbitrary commands via shell metacharacters in a request to a cgi-bin/ URI...
VulnCheck KEV: CVE-2019-11510
Ivanti Pulse Connect Secure contains an arbitrary file read vulnerability that allows an unauthenticated remote attacker with network access via HTTPS to send a specially crafted URI...
VulnCheck KEV: CVE-2019-2725
Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Web Services...
VulnCheck KEV: CVE-2017-13156
An elevation of privilege vulnerability in the Android system art. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-64211847...
VulnCheck KEV: CVE-2019-7286
Apple iOS, macOS, watchOS, and tvOS contain a memory corruption vulnerability that could allow for privilege escalation...
VulnCheck KEV: CVE-2017-11774
Microsoft Office Outlook contains a security feature bypass vulnerability due to improperly handling objects in memory. Successful exploitation allows an attacker to execute commands...
VulnCheck KEV: CVE-2018-8611
A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory...
VulnCheck KEV: CVE-2013-2678
Cisco Linksys E4200 1.0.05 Build 7 routers contain a Local File Include Vulnerability which could allow remote attackers to obtain sensitive information or execute arbitrary code by sending a crafted URL request to the apply.cgi script using the submittype parameter...
VulnCheck KEV: CVE-2018-4990
Adobe Acrobat and Reader have a double free vulnerability that could lead to remote code execution...
VulnCheck KEV: CVE-2018-8120
A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory...
VulnCheck KEV: CVE-2018-10468
The transferFrom function of a smart contract implementation for Useless Ethereum Token UET, an Ethereum ERC20 token, allows attackers to steal assets e.g., transfer all victims' balances into their account because certain computations involving value are incorrect, as exploited in the...
VulnCheck KEV: CVE-2018-8872
In Schneider Electric Triconex Tricon MP model 3008 firmware versions 10.0-10.4, system calls read directly from memory addresses within the control program area without any verification. Manipulating this data could allow attacker data to be copied anywhere within memory...
VulnCheck KEV: CVE-2025-34043
A remote command injection vulnerability exists in Vacron Network Video Recorder NVR devices v1.4 due to improper input sanitization in the board.cgi script. The vulnerability allows unauthenticated attackers to pass arbitrary commands to the underlying operating system via crafted HTTP...
VulnCheck KEV: CVE-1999-0192
Buffer overflow in telnet daemon tgetent routing allows remote attackers to gain root access via the TERMCAP environmental variable...
VulnCheck KEV: CVE-2004-1315
viewtopic.php in phpBB 2.x before 2.0.11 improperly URL decodes the highlight parameter when extracting words and phrases to highlight, which allows remote attackers to execute arbitrary PHP code by double-encoding the highlight value so that special characters are inserted into the result, which...
VulnCheck KEV: CVE-2009-2532
Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold and SP2, and Windows 7 RC do not properly process the command value in an SMB Multi-Protocol Negotiate Request packet, which allows remote attackers to execute arbitrary code via a crafted SMBv2 packet to the Server service, aka...
VulnCheck KEV: CVE-2017-0222
A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory...
VulnCheck KEV: CVE-2017-3197
GIGABYTE BRIX UEFI firmware for the GB-BSi7H-6500 version F6 and GB-BXi7-5775 version F2 platforms does not securely implement BIOSWE, BLE, SMMBWP, and PRx features. As a result, the BIOS is not protected from arbitrary write access and may permit modifications to the SPI flash...
VulnCheck KEV: CVE-2017-1274
IBM Domino 8.5.3, and 9.0 is vulnerable to a stack based overflow in the IMAP service that could allow an authenticated attacker to execute arbitrary code by specifying a large mailbox name. IBM X-Force ID: 124749...
VulnCheck KEV: CVE-1999-0502
A Unix account has a default, null, blank, or missing password...
VulnCheck KEV: CVE-2014-0564
Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and before 11.2.202.411 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allow attackers to execute arbitrary code or cause a denial...
VulnCheck KEV: CVE-2014-0160
The TLS and DTLS implementations in OpenSSL do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information...
VulnCheck KEV: CVE-2006-3227
Interpretation conflict between Internet Explorer and other web browsers such as Mozilla, Opera, and Firefox might allow remote attackers to modify the visual presentation of web pages and possibly bypass protection mechanisms such as content filters via ASCII characters with the 8th bit set,...
VulnCheck KEV: CVE-2014-1510
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary JavaScript code with chrome privileges by using an IDL fragment to trigger a window.open call...
VulnCheck KEV: CVE-2015-2424
Microsoft PowerPoint allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted Office document...
VulnCheck KEV: CVE-2014-8361
Realtek SDK contains an improper input validation vulnerability in the miniigd SOAP service that allows remote attackers to execute malicious code via a crafted NewInternalClient request...
VulnCheck KEV: CVE-2015-1701
An unspecified vulnerability exists in the Win32k.sys kernel-mode driver in Microsoft Windows Server that allows a local attacker to execute arbitrary code with elevated privileges...
VulnCheck KEV: CVE-2013-2551
Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute remote code via a crafted web site that triggers access to a deleted object...
VulnCheck KEV: CVE-2015-0310
Adobe Flash Player does not properly restrict discovery of memory addresses, which allows attackers to bypass the address space layout randomization ASLR protection mechanism...
VulnCheck KEV: CVE-2015-0016
Directory traversal vulnerability in the TS WebProxy TSWbPrxy component in Microsoft Windows allows remote attackers to escalate privileges...
VulnCheck KEV: CVE-2014-9163
Stack-based buffer overflow in Adobe Flash Player allows attackers to execute code remotely...
VulnCheck KEV: CVE-2014-8439
Adobe Flash Player has a vulnerability in the way it handles a dereferenced memory pointer which could lead to code execution...
VulnCheck KEV: CVE-2014-9734
Directory traversal vulnerability in the Slider Revolution revslider plugin before 4.2 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the img parameter in a revslidershowimage action to wp-admin/admin-ajax.php...
VulnCheck KEV: CVE-2014-2817
Microsoft Internet Explorer cotains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site...
VulnCheck KEV: CVE-2014-0322
Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute code...
VulnCheck KEV: CVE-2013-5057
hxds.dll in Microsoft Office 2007 SP3 and 2010 SP1 and SP2 does not implement the ASLR protection mechanism, which makes it easier for remote attackers to execute arbitrary code via a crafted COM component on a web site that is visited with Internet Explorer, as exploited in the wild in...
VulnCheck KEV: CVE-2013-3906
Microsoft Graphics Component contains a memory corruption vulnerability which can allow for remote code execution...
VulnCheck KEV: CVE-2013-2094
Linux kernel fails to check all 64 bits of attr.config passed by user space, resulting to out-of-bounds access of the perfsweventenabled array in swperfeventdestroy. Explotation allows for privilege escalation...
VulnCheck KEV: CVE-2018-11654
Information disclosure in Netwave IP camera at getstatus.cgi via HTTP on port 8000 allows an unauthenticated attacker to exfiltrate sensitive information from the device...
VulnCheck KEV: CVE-2013-0640
An memory corruption vulnerability exists in the acroform.dll in Adobe Reader that allows an attacker to perform remote code execution...
VulnCheck KEV: CVE-2013-0633
Buffer overflow in Adobe Flash Player before 10.3.183.51 and 11.x before 11.5.502.149 on Windows and Mac OS X, before 10.3.183.51 and 11.x before 11.2.202.262 on Linux, before 11.1.111.32 on Android 2.x and 3.x, and before 11.1.115.37 on Android 4.x allows remote attackers to execute arbitrary...