Lucene search

K

B&R Security Vulnerabilities

mageia
mageia

Updated microcode packages fix security vulnerabilities

The updated package fixes security vulnerabilities: Hardware logic contains race conditions in some Intel(R) Processors may allow an authenticated user to potentially enable partial information disclosure via local access. (CVE-2023-45733) Sequence of processor instructions leads to unexpected...

7.9CVSS

6.3AI Score

0.0004EPSS

2024-06-03 09:30 PM
6
githubexploit
githubexploit

Exploit for Race Condition in Apple Ipados

desc_race "desc_race" (CVE-2021-30955) exploit for iOS 15.0 -...

7.3AI Score

2022-03-15 01:30 PM
249
githubexploit

8.6CVSS

8.6AI Score

0.945EPSS

2024-06-10 01:29 AM
104
cvelist
cvelist

CVE-2021-47342 ext4: fix possible UAF when remounting r/o a mmp-protected file system

In the Linux kernel, the following vulnerability has been resolved: ext4: fix possible UAF when remounting r/o a mmp-protected file system After commit 618f003199c6 ("ext4: fix memory leak in ext4_fill_super"), after the file system is remounted read-only, there is a race where the kmmpd thread...

6.3AI Score

0.0004EPSS

2024-05-21 02:35 PM
vulnrichment
vulnrichment

CVE-2021-47342 ext4: fix possible UAF when remounting r/o a mmp-protected file system

In the Linux kernel, the following vulnerability has been resolved: ext4: fix possible UAF when remounting r/o a mmp-protected file system After commit 618f003199c6 ("ext4: fix memory leak in ext4_fill_super"), after the file system is remounted read-only, there is a race where the kmmpd thread...

6.8AI Score

0.0004EPSS

2024-05-21 02:35 PM
githubexploit
githubexploit

Exploit for Untrusted Pointer Dereference in Microsoft

CVE-2023-21768 Local Privilege Escalation POC authors:...

7.8CVSS

8.2AI Score

0.003EPSS

2023-03-07 11:00 PM
387
osv
osv

Tornado has a CRLF injection in CurlAsyncHTTPClient headers

Summary Tornado’s curl_httpclient.CurlAsyncHTTPClient class is vulnerable to CRLF (carriage return/line feed) injection in the request headers. Details When an HTTP request is sent using CurlAsyncHTTPClient, Tornado does not reject carriage return (\r) or line feed (\n) characters in the request...

7.5AI Score

2024-06-06 09:46 PM
2
githubexploit
githubexploit

Exploit for Deserialization of Untrusted Data in Apache Log4J

Log4jCenter Exploiting CVE-2021-44228 in vCenter for remote...

9.2AI Score

2021-12-19 02:48 PM
448
githubexploit
githubexploit

Exploit for Improper Validation of Specified Quantity in Input in Linux Linux Kernel

RNDIS-CO Summary The RNDIS USB Gadget may be exploited...

6.9AI Score

2022-02-17 02:02 PM
390
f5
f5

K000139880: Intel CPU/BIOS vulnerabilities CVE-2023-28402, CVE-2023-27504, and CVE-2023-28383

Security Advisory Description CVE-2023-28402 Improper input validation in some Intel(R) BIOS Guard firmware may allow a privileged user to potentially enable escalation of privilege via local access. CVE-2023-27504 Improper conditions check in some Intel(R) BIOS Guard firmware may allow a...

7.2CVSS

6.5AI Score

0.0004EPSS

2024-06-03 12:00 AM
5
ibm
ibm

Security Bulletin: Multiple vulnerabilities in Open JDK affecting Rational Functional Tester / DevOps Test UI

Summary There are multiple vulnerabilities in Open JDK Version 8, OpenJ9 used by Rational Functional Tester (RFT) / DevOps Test UI. RFT has addressed the applicable CVEs. Vulnerability Details ** CVEID: CVE-2024-21085 DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM...

3.7CVSS

7.2AI Score

0.001EPSS

2024-06-12 06:36 AM
3
nuclei
nuclei

Horde/Horde Groupware - Local File Inclusion

Horde before 3.2.4 and 3.3.3 and Horde Groupware before 1.1.5 are susceptible to local file inclusion in framework/Image/Image.php because it allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the Horde_Image driver...

6.7AI Score

0.04EPSS

2021-07-27 05:32 AM
4
nessus
nessus

R Programming Language 1.4.0 < 4.4.0 Insecure Deserialization

The version of the R Programming Language running on the remote host is 1.4.0 or later, before 4.4.0. It is, therefore, affected by an insecure deserialization vulnerability. Deserialization of untrusted data can occur, enabling a maliciously crafted RDS (R Data Serialization) formatted file or R.....

8.8CVSS

7.9AI Score

0.0004EPSS

2024-05-09 12:00 AM
5
nuclei
nuclei

Amcrest IP Camera Web Management - Data Exposure

Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices allow an unauthenticated attacker to download the administrative...

9.8CVSS

9.6AI Score

0.929EPSS

2023-08-10 05:18 AM
8
nuclei
nuclei

CrushFTP VFS - Sandbox Escape LFR

VFS Sandbox Escape in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows remote attackers with low privileges to read files from the filesystem outside of VFS...

10CVSS

9.2AI Score

0.966EPSS

2024-04-23 11:49 AM
20
githubexploit
githubexploit

Exploit for Use After Free in Microsoft

CVE-2023-36802 Local Privilege Escalation POC authors:...

7.8CVSS

6.7AI Score

0.001EPSS

2023-10-09 05:32 PM
28
openbugbounty
openbugbounty

n-e-r-v-o-u-s.com Cross Site Scripting vulnerability OBB-3857032

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently...

6.2AI Score

2024-02-23 01:31 PM
2
githubexploit

8.6CVSS

6.2AI Score

0.945EPSS

2024-06-02 08:16 PM
75
osv
osv

CVE-2022-41804

Unauthorized error injection in Intel(R) SGX or Intel(R) TDX for some Intel(R) Xeon(R) Processors may allow a privileged user to potentially enable escalation of privilege via local...

7.2CVSS

7.3AI Score

0.0004EPSS

2023-08-11 03:15 AM
22
githubexploit
githubexploit

Exploit for Path Traversal in Igniterealtime Openfire

CVE-2023-32315 Openfire Console Authentication Bypass...

8.6CVSS

8.1AI Score

0.973EPSS

2023-06-18 03:42 PM
418
osv
osv

CVE-2023-22655

Protection mechanism failure in some 3rd and 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege via local...

6.1CVSS

6.8AI Score

0.001EPSS

2024-03-14 05:15 PM
1
github
github

CrateDB has a Client initialized Session-Renegotiation DoS

Summary Client-Initiated TLS Renegotiation Denial of Service (DoS) Vulnerability at Port 4200 Details A high-risk vulnerability has been identified where the TLS endpoint (port 4200) permits client-initiated renegotiation. In this scenario, an attacker can exploit this feature to repeatedly...

5.3CVSS

6.9AI Score

0.0004EPSS

2024-06-13 07:39 PM
1
githubexploit
githubexploit

Exploit for Inadequate Encryption Strength in Alpha-Innotec Heat Pumps Firmware

CVE-2024-22894 Downloaded the latest heatpump firmware...

6.8CVSS

7AI Score

0.001EPSS

2024-01-27 06:17 PM
11
fedora
fedora

[SECURITY] Fedora 40 Update: qt5-qtwebsockets-5.15.14-1.fc40

The QtWebSockets module implements the WebSocket protocol as specified in R FC 6455. It solely depends on Qt (no external...

6.5AI Score

0.0004EPSS

2024-06-05 01:41 AM
1
redhat
redhat

(RHSA-2024:3422) Important: linux-firmware security update

The linux-firmware packages contain all of the firmware files that are required by various devices to operate. Security Fix(es): linux-firmware: hw: intel: Improper access control for some Intel(R) PROSet/Wireless WiFi (CVE-2022-27635) linux-firmware: hw: intel: Improper access control for...

7AI Score

0.0004EPSS

2024-05-28 01:04 PM
4
osv
osv

CVE-2023-43490

Incorrect calculation in microcode keying mechanism for some Intel(R) Xeon(R) D Processors with Intel(R) SGX may allow a privileged user to potentially enable information disclosure via local...

5.3CVSS

5.6AI Score

0.0004EPSS

2024-03-14 05:15 PM
3
f5
f5

K000140039: Intel QAT vulnerability CVE-2023-32641

Security Advisory Description Improper input validation in firmware for Intel(R) QAT before version QAT20.L.1.0.40-00004 may allow escalation of privilege and denial of service via adjacent access. (CVE-2023-32641) Impact There is no impact; F5 products are not affected by this...

8.8CVSS

7.5AI Score

0.001EPSS

2024-06-18 12:00 AM
5
osv
osv

CVE-2024-23171

An issue was discovered in the CampaignEvents extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. The Special:EventDetails page allows XSS via the x-xss language setting for internationalization...

5.4CVSS

5.3AI Score

0.0004EPSS

2024-01-12 05:15 AM
2
github
github

Tornado has a CRLF injection in CurlAsyncHTTPClient headers

Summary Tornado’s curl_httpclient.CurlAsyncHTTPClient class is vulnerable to CRLF (carriage return/line feed) injection in the request headers. Details When an HTTP request is sent using CurlAsyncHTTPClient, Tornado does not reject carriage return (\r) or line feed (\n) characters in the request...

7.5AI Score

2024-06-06 09:46 PM
4
alpinelinux
alpinelinux

CVE-2023-45733

Hardware logic contains race conditions in some Intel(R) Processors may allow an authenticated user to potentially enable partial information disclosure via local...

2.8CVSS

5AI Score

0.0004EPSS

2024-05-16 09:15 PM
10
osv
osv

CVE-2022-33196

Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R) Processors when using Intel(R) Software Guard Extensions which may allow a privileged user to potentially enable escalation of privilege via local...

7.2CVSS

7AI Score

0.0004EPSS

2023-02-16 09:15 PM
11
alpinelinux
alpinelinux

CVE-2023-39368

Protection mechanism failure of bus lock regulator for some Intel(R) Processors may allow an unauthenticated user to potentially enable denial of service via network...

6.5CVSS

6.6AI Score

0.001EPSS

2024-03-14 05:15 PM
10
githubexploit
githubexploit

Exploit for Code Injection in Crushftp

CVE-2024-4040 - exploit scanners This repository contains...

10CVSS

9.5AI Score

0.966EPSS

2024-04-23 09:31 AM
287
githubexploit
githubexploit

Exploit for CVE-2023-33733

CVE-2023-33733 on Reportlab v3.6.12 This lab was set up to...

7.8CVSS

7.7AI Score

0.001EPSS

2024-04-22 09:32 AM
277
nuclei
nuclei

WAVLINK WN530HG4 - Improper Access Control

WAVLINK WN530HG4 M30HG4.V5030.191116 is susceptible to improper access control. An attacker can obtain usernames and passwords via view-source:http://IP_ADDRESS/set_safety.shtml?r=52300 and searching for [var syspasswd] and thereby possibly obtain sensitive information, modify data, and/or execute....

7.5CVSS

7.7AI Score

0.143EPSS

2022-07-20 07:39 PM
4
osv
osv

CrateDB has a Client initialized Session-Renegotiation DoS

Summary Client-Initiated TLS Renegotiation Denial of Service (DoS) Vulnerability at Port 4200 Details A high-risk vulnerability has been identified where the TLS endpoint (port 4200) permits client-initiated renegotiation. In this scenario, an attacker can exploit this feature to repeatedly...

5.3CVSS

6.9AI Score

0.0004EPSS

2024-06-13 07:39 PM
2
githubexploit
githubexploit

Exploit for Path Traversal in Sysaid Sysaid On-Premises

Vulnerability Details fofa: ```text ...

9.8CVSS

9.6AI Score

0.943EPSS

2023-11-17 07:03 AM
319
githubexploit
githubexploit

Exploit for Out-of-bounds Write in Fortinet Fortiproxy

FortiGate cve-2024-21762-checker This script is used to check...

9.8CVSS

7.2AI Score

0.018EPSS

2024-06-20 02:58 AM
102
alpinelinux
alpinelinux

CVE-2023-46103

Sequence of processor instructions leads to unexpected behavior in Intel(R) Core(TM) Ultra Processors may allow an authenticated user to potentially enable denial of service via local...

4.7CVSS

5.7AI Score

0.0004EPSS

2024-05-16 09:15 PM
9
githubexploit
githubexploit

Exploit for CVE-2024-0757

CVE-2024-0757 (Exploit) Description The Insert or Embed...

8AI Score

0.0004EPSS

2024-06-17 07:46 AM
114
osv
osv

CVE-2023-28938

Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service via local...

4.4CVSS

6.8AI Score

0.0004EPSS

2023-08-11 03:15 AM
1
githubexploit
githubexploit

Exploit for Code Injection in Apache Ofbiz

ofbiz-CVE-2023-49070-RCE-POC This is a pre-auth RCE POC For...

9.8CVSS

6.6AI Score

0.798EPSS

2023-12-14 09:32 AM
355
nuclei
nuclei

WAVLINK WN533A8 - Improper Access Control

WAVLINK WN533A8 M33A8.V5030.190716 is susceptible to improper access control. An attacker can obtain usernames and passwords via view-source:http://IP_ADDRESS/sysinit.shtml?r=52300 and searching for [logincheck(user);] and thereby possibly obtain sensitive information, modify data, and/or execute.....

7.5CVSS

7.7AI Score

0.143EPSS

2022-07-20 07:52 PM
2
githubexploit
githubexploit

Exploit for Improper Authentication in Automattic Woocommerce Payments

CVE-2023-28121 WooCommerce Payments &lt; 5.6.2 - Unauthenticated...

9.8CVSS

9.3AI Score

0.924EPSS

2023-07-12 02:41 AM
211
osv
osv

CVE-2022-35961

OpenZeppelin Contracts is a library for secure smart contract development. The functions ECDSA.recover and ECDSA.tryRecover are vulnerable to a kind of signature malleability due to accepting EIP-2098 compact signatures in addition to the traditional 65 byte signature format. This is only an issue....

7.9CVSS

6.5AI Score

0.001EPSS

2022-08-15 11:21 AM
2
osv
osv

BIT-artifactory-2024-2248

A Header Injection vulnerability in the JFrog platform in versions below 7.85.0 (SaaS) and 7.84.7 (Self-Hosted) may allow threat actors to take over the end user's account when clicking on a specially crafted URL sent to the victim’s user...

6.4CVSS

7.1AI Score

0.0004EPSS

2024-05-29 10:40 AM
2
nuclei
nuclei

Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting

Open-School 3.0, and Community Edition 2.3, allows cross-site scripting via the osv/index.php?r=students/guardians/create id...

6.1CVSS

6AI Score

0.004EPSS

2020-09-04 03:46 PM
2
githubexploit
githubexploit

Exploit for Authentication Bypass by Spoofing in Telerik Report Server 2024

CVE-2024-4358_Mass_Exploit Modified tools from @sinsinology...

9.8CVSS

9.7AI Score

0.938EPSS

2024-06-05 01:05 AM
123
osv
osv

CVE-2023-23908

Improper access control in some 3rd Generation Intel(R) Xeon(R) Scalable processors may allow a privileged user to potentially enable information disclosure via local...

6CVSS

6AI Score

0.0004EPSS

2023-08-11 03:15 AM
17
githubexploit
githubexploit

Exploit for Exposure of Resource to Wrong Sphere in Microsoft

Blank Space Blank Space is a refactoring of James Forshaw's...

8.6AI Score

2022-02-04 05:11 PM
445
Total number of security vulnerabilities101215