Ransomware-flagged CVEs
Common Vulnerabilities and Exposures (CVEs) flagged as used in ransomware campaigns by the Cybersecurity and Infrastructure Security Agency (CISA) or by VulnCheck's Known Exploited Vulnerabilities (KEV) catalog, with this tracker's own active-exploitation evidence on top of that flag.
Every entry below is CURRENTLY FLAGGED, never CLOSED. No source this tracker ingests reports when exploitation of a CVE stops, so this page never states that a campaign has ended. The days-since figure names the freshest dated exploitation reading this tracker has retained and the authority that made it, so a slowing campaign is visible without ever being called over. Each Common Vulnerability Scoring System (CVSS) score shown below is this tracker's own already-selected score for that CVE, not computed here. This list is the ransomware-flagged set, so it is not a ranking of what attackers are exploiting right now: for current mass exploitation, open the active-exploitation view of every tracked CVE.
533 CVEs currently flagged, most recent evidence first. CISA's own flag: 361. VulnCheck KEV only: 172.
An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly...
2 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized...
2 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology...
15 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before...
15 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager ...
15 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Werkzeug is a Web Server Gateway Interface web application library. On Python < 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share. Werkzeug's safe_join() relies on this check, and so can produce a path that is not safe, potentially allowing unintended access to data. Applications using Python >= 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch.
44 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
A weakness in the certificate validation logic of the deprecated IKEv1 key exchange may allow an...
58 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability...
73 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.
87 days since the last new exploitation evidence (evidence: , CISA KEV)
JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.
100 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.
107 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location.
122 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
SonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.
122 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network.
135 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
PTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request to the network.
141 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
A vulnerability in the K7RKScan.sys driver, part of the K7 Security Anti-Malware suite, allows a local low-privilege user to send crafted IOCTL requests to terminate a wide range of processes running with administrative or system-level privileges, with the exception of those inherently protected by the operating system. This flaw stems from missing access control in the driver's IOCTL handler, enabling unprivileged users to perform privileged actions in kernel space. Successful exploitation can lead to denial of service by disrupting critical services or privileged applications.
150 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools.
154 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.
158 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection.
168 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity.
170 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published. The compromised extension fetched an obfuscated payload that could harvested credentials from multiple sources on disk and in memory.
170 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling...
178 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing...
178 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing...
178 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability...
196 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all...
196 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
197 days since the last new exploitation evidence (evidence: , ENISA EUVD)
ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems.
199 days since the last new exploitation evidence (evidence: , ENISA EUVD)
SimpleHelp contains a missing authorization vulnerability that could allow low-privileged technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.
203 days since the last new exploitation evidence (evidence: , ENISA EUVD)
SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.
203 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally.
204 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
PaperCut NG/MF contains an improper authentication vulnerability that could allow remote attackers to bypass authentication on affected installations via the SecurityRequestFilter class.
207 days since the last new exploitation evidence (evidence: , ENISA EUVD)
JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed.
207 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Microsoft Exchange Server contains a deserialization of untrusted data that allows an authenticated attacker to achieve remote code execution.
214 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Microsoft Windows contains a link following vulnerability that allows for privilege escalation
214 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.
239 days since the last new exploitation evidence (evidence: , ENISA EUVD)
SolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that could allow an attacker to run commands on the host machine.
249 days since the last new exploitation evidence (evidence: , ENISA EUVD)
An exposed ioctl in the IMFForceDelete driver of IObit Malware Fighter v12.1.0 allows attackers to arbitrarily delete files and escalate privileges.
260 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption.
272 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
STProcessMonitor 11.11.4.0, part of the Safetica Application suite, allows an admin-privileged user to send crafted IOCTL requests to terminate processes that are protected through a third-party implementation. This is caused by insufficient caller validation in the driver's IOCTL handler, enabling unauthorized processes to perform those actions in kernel space. Successful exploitation can lead to denial of service by disrupting critical third-party services or applications. Unauthorized processes load the driver and send a crafted IOCTL request (0xB822200C) to terminate processes protected by a third-party implementation. This action exploits insufficient caller validation in the driver's IOCTL handler, allowing unauthorized processes to perform termination operations in kernel space. Successful exploitation can lead to denial of service by disrupting critical third-party services or applications.
275 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution.
281 days since the last new exploitation evidence (evidence: , ENISA EUVD)
NSecsoft 'NSecKrnl' is a Windows driver that allows a local, authenticated attacker to terminate processes owned by other users, including SYSTEM and Protected Processes by issuing crafted IOCTL requests to the driver.
281 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
The GameDriverX64.sys kernel-mode anti-cheat driver (v7.23.4.7 and earlier) contains an access control vulnerability in one of its IOCTL handlers. A user-mode process can open a handle to the driver device and send specially crafted IOCTL requests. These requests are executed in kernel-mode context without proper authentication or access validation, allowing the attacker to terminate arbitrary processes, including critical system and security services, without requiring administrative privileges.
288 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.
290 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
SmarterTools SmarterMail contains an authentication bypass using an alternate path or channel vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. This could allow an unauthenticated attacker to supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance.
291 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.
325 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
WatchGuard Fireware OS iked process contains an out of bounds write vulnerability in the OS iked process. This vulnerability may allow a remote unauthenticated attacker to execute arbitrary code and affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.
329 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Atlassian Confluence Server and Data Server contain an Object-Graph Navigation Language (OGNL) injection vulnerability that may allow an unauthenticated attacker to execute code.
332 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
An elevation of privilege vulnerability exists in .NET Framework which could allow an attacker to...
340 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.
343 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Adobe Flash Player contains a use-after-free vulnerability that could allow for code execution.
361 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch. The Admin.Client.UpdateClientConfig is an artifact used to update the client's configuration. This artifact did not enforce an additional required permission, allowing users with COLLECT_CLIENT permissions (normally given by the "Investigator" role) to collect it from endpoints and update the configuration. This can lead to arbitrary command execution and endpoint takeover. To successfully exploit this vulnerability the user must already have access to collect artifacts from the endpoint (i.e. have the COLLECT_CLIENT given typically by the "Investigator' role).
387 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime component of Oracle Configurator. This vulnerability is remotely exploitable without authentication.
389 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Microsoft Windows Common Log File System Driver contains a privilege escalation vulnerability that could allow a local, privileged attacker to bypass certain security mechanisms.
403 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component. The vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks can result in takeover of Oracle Concurrent Processing.
403 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Fortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
410 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Howyar UEFI Application "Reloader" (32-bit and 64-bit) is vulnerable to execution of unsigned software in a hardcoded path.
413 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
An issue in the BdApiUtil driver of Baidu Antivirus v5.2.3.116083 allows attackers to terminate arbitrary process via executing a BYOVD (Bring Your Own Vulnerable Driver) attack.
422 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Certain APIs within BigInsights can take invalid input that might allow attackers unauthorized access to read, write, modify, or delete data.
451 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.
451 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests.
455 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise.
455 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
RARLAB WinRAR contains a path traversal vulnerability affecting the Windows version of WinRAR. This vulnerability could allow an attacker to execute arbitrary code by crafting malicious archive files.
458 days since the last new exploitation evidence (evidence: , ENISA EUVD)
ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and...
465 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Microsoft Streaming Service Elevation of Privilege Vulnerability
469 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Microsoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-49706. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.
479 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. CVE-2025-53771 is a patch bypass for CVE-2025-49706, and the updates for CVE-2025-53771 include more robust protection than those for CVE-2025-49706.
479 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-53771. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.
481 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
483 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.
491 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key.
506 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Windows Hyper-V Remote Code Execution Vulnerability
521 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Paragon Partition Manager version 7.9.1 contains an arbitrary kernel memory mapping vulnerability...
526 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Paragon Partition Manager version 7.9.1 contains an arbitrary kernel memory write vulnerability...
526 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Various Paragon Software products contain a null pointer dereference vulnerability within biontdrv.sys that is caused by a lack of a valid MasterLrp structure in the input buffer, allowing an attacker to execute arbitrary code in the kernel, facilitating privilege escalation.
526 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Paragon Partition Manager version 7.9.1 contains an arbitrary kernel memory vulnerability...
526 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Accellion FTA contains a SQL injection vulnerability exploited via a crafted host header in a request to document_root.html.
535 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Accellion FTA contains an OS command injection vulnerability exploited via a local web service call.
535 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Accellion FTA contains a server-side request forgery (SSRF) vulnerability exploited via a crafted POST request to wmProgressstat.html.
535 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Accellion FTA contains an OS command injection vulnerability exploited via a crafted POST request to various admin endpoints.
535 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content.
547 days since the last new exploitation evidence (evidence: , ENISA EUVD)
SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries.
563 days since the last new exploitation evidence (evidence: , ENISA EUVD)
GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 10.0.18.
575 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
584 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution.
588 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Improper Input Validation vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server...
604 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Untrusted Search Path vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server Container...
604 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
The Slider Revolution WordPress plugin through 6.6.12 does not check for valid image files upon...
604 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Unrestricted Upload of File with Dangerous Type vulnerability in ThemePunch OHG Slider Revolution...
604 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
The Unlimited Addons for WPBakery Page Builder plugin for WordPress is vulnerable to arbitrary...
604 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
The Porto theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and...
604 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
The Porto theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and...
604 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
The Porto Theme - Functionality plugin for WordPress is vulnerable to Local File Inclusion in all...
604 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
The Porto Theme - Functionality plugin for WordPress is vulnerable to Local File Inclusion in all...
604 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')...
604 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.
605 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Microsoft Windows Management Console (MMC) contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally.
610 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
VMware ESXi contains an arbitrary write vulnerability. Successful exploitation allows an attacker with privileges within the VMX process to trigger an arbitrary kernel write leading to an escape of the sandbox.
619 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Microsoft Windows Win32k contains an improper resource shutdown or release vulnerability that allows for local, authenticated privilege escalation. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.
620 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Paragon Partition Manager version 17, both community and Business versions, contain an insecure...
623 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
An improper neutralization of special elements used in an os command ('os command injection') in...
626 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
An improper neutralization of special elements used in an os command ('os command injection') in...
626 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
SonicWall SonicOS contains an improper authentication vulnerability in the SSLVPN authentication mechanism that allows a remote attacker to bypass authentication.
633 days since the last new exploitation evidence (evidence: , ENISA EUVD)
SimpleHelp remote support software contains multiple path traversal vulnerabilities that allow unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files may include server configuration files and hashed user passwords.
638 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)...
638 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46748.
641 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
A vulnerability in the way Java restricts the permissions of Java applets could allow an attacker to execute commands on a vulnerable system.
641 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
The SMBv1 server in Microsoft Windows allows remote attackers to obtain sensitive information from process memory via a crafted packet.
641 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
The SMBv1 server in Microsoft allows remote attackers to execute arbitrary code via crafted packets.
641 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to 2D
641 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
The Client-Server Run-time Subsystem (CSRSS) in Microsoft mismanages process tokens, which allows local users to gain privileges via a crafted application.
641 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
The Microsoft JScript nd VBScript engines, as used in Internet Explorer and other products, allow attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.
641 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Windows COM Aggregate Marshaler allows for privilege escalation when an attacker runs a specially crafted application.
641 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.
641 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
A privilege escalation vulnerability exists when the Windows Transaction Manager improperly handles objects in memory.
641 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Adobe Acrobat and Reader contain an input validation issue in a JavaScript method that could potentially lead to remote code execution.
641 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
A privilege escalation vulnerability exists in Microsoft Windows if the Windows Secondary Logon Service fails to properly manage request handles in memory. An attacker who successfully exploited this vulnerability could run arbitrary code as an administrator.
641 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft MSCOMCTL.OCX contains an unspecified vulnerability that allows for remote code execution, allowing an attacker to take complete control of an affected system under the context of the current user.
641 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Windows Active Directory contains a privilege escalation vulnerability due to the way it distributes passwords that are configured using Group Policy preferences. An authenticated attacker who successfully exploits the vulnerability could decrypt the passwords and use them to elevate privileges on the domain.
641 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation via a crafted application
641 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Windows Server Message Block 1.0 (SMBv1) contains an unspecified vulnerability that allows for remote code execution.
641 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Office and WordPad contain an unspecified vulnerability due to the way the applications parse specially crafted files. Successful exploitation allows for remote code execution.
641 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Office contains a memory corruption vulnerability that allows remote code execution in the context of the current user.
641 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
CyberoamOS (CROS) contains a SQL injection vulnerability in the WebAdmin that allows an unauthenticated attacker to execute arbitrary SQL statements remotely.
644 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Windows Certificate Dialog contains a privilege escalation vulnerability, allowing attackers to run processes in an elevated context.
644 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Samba contains a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share and then cause the server to load and execute it.
644 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute remote code via a crafted web site that triggers access to a deleted object.
644 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.
644 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.
644 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC).
644 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a pre-authorization arbitrary file read vulnerability in the /s/ endpoint.
644 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
In some versions of PHP in certain configurations of FPM setup, it is possible to cause FPM module to write past allocated buffers allowing the possibility of remote code execution.
644 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Palo Alto Networks PAN-OS contains a vulnerability in SAML which allows an attacker to bypass authentication.
644 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.
644 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.
644 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.
644 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
A privilege escalation vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.
644 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
A privilege escalation vulnerability exists when Windows Error Reporting manager improperly handles hard links. An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status.
644 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Unspecified vulnerability allows for an authenticated user to escalate privileges.
644 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
DotNetNuke (DNN) contains a vulnerability that may allow for remote code execution via cookie deserialization.
644 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0798.
644 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Exim contains a buffer overflow vulnerability in the base64d function part of the SMTP listener that may allow for remote code execution.
644 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Drupal Core contains a remote code execution vulnerability that could allow an attacker to exploit multiple attack vectors on a Drupal site, resulting in complete site compromise.
644 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft SharePoint fails to check the source markup of an application package. An attacker who successfully exploits the vulnerability could run remote code in the context of the SharePoint application pool and the SharePoint server farm account.
644 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Remote Desktop Services, formerly known as Terminal Service, contains an unspecified vulnerability that allows an unauthenticated attacker to connect to the target system using RDP and send specially crafted requests. Successful exploitation allows for remote code execution. The vulnerability is also known under the moniker of BlueKeep.
644 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Win32k contains an unspecified vulnerability due to it failing to properly handle objects in memory causing privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.
644 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Win32k fails to properly handle objects in memory causing privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.
644 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Atlassian Crowd and Crowd Data Center contain a remote code execution vulnerability resulting from a pdkinstall development plugin being incorrectly enabled in release builds.
644 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Windows contains an unspecified vulnerability due to the way ws2ifsl.sys (Winsock) handles objects in memory, allowing for privilege escalation. Successful exploitation allows an attacker to execute code with elevated privileges.
644 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Internet Explorer contains a memory corruption vulnerability in how the scripting engine handles objects in memory. Successful exploitation allows for remote code execution in the context of the current user.
644 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Atlassian Confluence Server and Data Center contain a server-side template injection vulnerability that may allow an attacker to achieve path traversal and remote code execution.
644 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
VMware ESXi and Horizon Desktop as a Service (DaaS) OpenSLP contains a heap-based buffer overflow vulnerability that allows an attacker with network access to port 427 to overwrite the heap of the OpenSLP service to perform remote code execution.
644 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Internet Explorer contains a memory corruption vulnerability due to how the Scripting Engine handles objects in memory, leading to remote code execution.
644 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
QNAP NAS devices running Photo Station contain an improper access control vulnerability allowing remote attackers to gain unauthorized access to the system.
645 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
QNAP QTS contains an improper input validation vulnerability allowing remote attackers to inject code on the system.
645 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.
645 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.
645 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall.
645 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution.
645 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft SharePoint Server contains an unspecified vulnerability that allows an unauthenticated attacker, who has gained access to spoofed JWT authentication tokens, to use them for executing a network attack. This attack bypasses authentication, enabling the attacker to gain administrator privileges.
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Laravel Ignition contains a file upload vulnerability that allows unauthenticated remote attackers to execute malicious code due to insecure usage of file_get_contents() and file_put_contents().
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Exchange Server contains an unspecified vulnerability that allows for authenticated remote code execution. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41040 which allows for the remote code execution.
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Multiple D-Link routers contain an unspecified vulnerability that allows for execution of OS commands.
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Atlassian Confluence Server and Data Center contain a remote code execution vulnerability that allows for an unauthenticated attacker to perform remote code execution.
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
The login_mgr.cgi script in D-Link DNS-320 is vulnerable to remote code execution.
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
VMware Workspace ONE Access and Identity Manager allow for remote code execution due to server-side template injection.
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Windows Common Log File System (CLFS) Driver contains an unspecified vulnerability that allows for privilege escalation.
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10561, exploitation can allow an attacker to perform remote code execution.
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
SonicWall Secure Remote Access (SRA) products contain an improper neutralization of a SQL Command leading to SQL injection.
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Office Access Connectivity Engine contains an unspecified vulnerability which can allow for remote code execution.
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
The SMBv1 server in Microsoft Windows allows remote attackers to perform remote code execution.
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Improper Access Control in Citrix ShareFile storage zones controller may allow an unauthenticated attacker to remotely compromise the storage zones controller.
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
A privilege escalation vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context.
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
A privilege escalation vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context.
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Adobe Flash Player allows remote attackers to execute arbitrary code via a crafted SWF file.
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
A privilege escalation vulnerability exists in Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could attempt to impersonate any other user of the Exchange server.
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Windows Installer contains an unspecified vulnerability that allows for privilege escalation.
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
SonicWall SMA 100 devies are vulnerable to an unauthenticated stack-based buffer overflow vulnerability where exploitation can result in code execution.
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Citrix StoreFront Server contains an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information.
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Progress Telerik UI for ASP.NET AJAX contains a deserialization of untrusted data vulnerability through RadAsyncUpload which leads to code execution on the server in the context of the w3wp.exe process.
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Exchange Server Validation Key fails to properly create unique keys at install time, allowing for remote code execution.
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Edge and Internet Explorer contain a memory corruption vulnerability that allows attackers to execute code in the context of the current user.
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Sophos Firewall operating system (SFOS) firmware contains a SQL injection vulnerability when configured with either the administration (HTTPS) service or the User Portal is exposed on the WAN zone. Successful exploitation may cause remote code execution to exfiltrate usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords).
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Exchange Server contains an unspecified vulnerability that allows for security feature bypass.
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution.
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
SolarWinds Serv-U contains an unspecified memory escape vulnerability which can allow for remote code execution.
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
ForgeRock Access Management (AM) Core Server allows an attacker who sends a specially crafted HTTP request to one of three endpoints (/ccversion/Version, /ccversion/Masthead, or /ccversion/ButtonFrame) to execute code in the context of the current user (unless ForgeRock AM is running as root user, which the vendor does not recommend).
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM.
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing remote code execution.
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default �require all denied� or if CGI scripts are enabled. The original patch issued under this CVE ID is insufficient, please review remediation information under CVE-2021-42013.
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default require all denied or if CGI scripts are enabled. This CVE ID resolves an incomplete patch for CVE-2021-41773.
647 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core contain an authentication bypass vulnerability that allows unauthorized users to access restricted functionality or resources of the application.
648 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Atlassian Confluence Data Center and Server contain an improper authorization vulnerability that can result in significant data loss when exploited by an unauthenticated attacker. There is no impact on confidentiality since the attacker cannot exfiltrate any data.
648 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system.
648 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
648 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
648 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Sitcore XP contains an insecure deserialization vulnerability which can allow for remote code execution.
648 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Ivanti Pulse Connect Secure contains an arbitrary file read vulnerability that allows an unauthenticated remote attacker with network access via HTTPS to send a specially crafted URI.
648 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Ivanti Pulse Connect Secure and Policy Secure allows an authenticated attacker from the admin web interface to inject and execute commands.
648 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Zoho ManageEngine ADSelfService Plus contains an authentication bypass vulnerability affecting the REST API URLs which allow for remote code execution.
648 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
BQE BillQuick Web Suite contains an SQL injection vulnerability when accessing the username parameter that may allow for unauthenticated, remote code execution.
648 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
ZK Framework AuUploader servlets contain an unspecified vulnerability that could allow an attacker to retrieve the content of a file located in the web context. The ZK Framework is an open-source Java framework. This vulnerability can impact multiple products, including but not limited to ConnectWise R1Soft Server Backup Manager.
653 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML deserialization flaw.
653 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services.
653 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Multiple WSO2 products allow for unrestricted file upload, resulting in remote code execution.
653 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Windows Print Spooler contains an unspecified vulnerability which can allow for privilege escalation.
653 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
SAP Customer Relationship Management (CRM) contains a path traversal vulnerability that allows an attacker to exploit insufficient validation of path information provided by users.
653 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
F5 BIG-IP Traffic Management User Interface (TMUI) contains a remote code execution vulnerability in undisclosed pages.
653 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
VMware vCenter Server contains a file upload vulnerability in the Analytics service that allows a user with network access to port 443 to execute code.
653 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
F5 BIG-IP and BIG-IQ Centralized Management contain a remote code execution vulnerability in the iControl REST interface that allows unauthenticated attackers with network access to execute system commands, create or delete files, and disable services.
653 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts.
654 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
The Mitel Edge Gateway component of MiVoice Connect allows an authenticated attacker with internal network access to execute commands within the context of the system.
654 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
The Director component in Mitel MiVoice Connect allows an authenticated attacker with internal network access to execute code within the context of the application.
654 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user.
655 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC) contain a deserialization of untrusted data vulnerability, which can enable a remote, unauthenticated attacker to execute arbitrary OS commands.
658 days since the last new exploitation evidence (evidence: , ENISA EUVD)
From the VSPC management agent machine, under condition that the management agent is authorized...
659 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.
660 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.
669 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Mitel MiCollab contains a path traversal vulnerability that could allow an authenticated attacker with administrative privileges to read local files within the system due to insufficient input sanitization. This vulnerability can be chained with CVE-2024-41713, which allows an unauthenticated, remote attacker to read arbitrary files on the server.
672 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which can lead to unauthenticated remote code execution.
674 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy...
674 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Mitel MiCollab contains a path traversal vulnerability that could allow an attacker to gain unauthorized and unauthenticated access. This vulnerability can be chained with CVE-2024-55550, which allows an unauthenticated, remote attacker to read arbitrary files on the server.
675 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload vulnerability that could allow an unauthenticated user to import and execute arbitrary bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.
696 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code execution with elevated privileges.
700 days since the last new exploitation evidence (evidence: , ENISA EUVD)
CyberPanel contains an incorrect default permissions vulnerability that allows for authentication bypass and the execution of arbitrary commands using shell metacharacters in the statusfile property.
708 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL.
708 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Array Networks AG and vxAG ArrayOS contain a missing authentication for critical function vulnerability that allows an attacker to read local files and execute code on the SSL VPN gateway.
718 days since the last new exploitation evidence (evidence: , ENISA EUVD)
A command injection vulnerability in the IPSec VPN feature of Zyxel ATP series firmware versions...
718 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators.
725 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators.
725 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Microsoft Windows Task Scheduler contains a privilege escalation vulnerability that can allow an attacker-provided, local application to escalate privileges outside of its AppContainer, and access privileged RPC functions.
731 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an insufficient input validation vulnerability for user-supplied input by the web services interface. Successful exploitation could allow an attacker to perform cross-site scripting (XSS) in the context of the interface or access sensitive browser-based information.
735 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
CyberPanel contains an incorrect default permissions vulnerability that allows a remote, unauthenticated attacker to execute commands as root.
736 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Veeam Backup and Replication contains a deserialization vulnerability allowing an unauthenticated user to perform remote code execution.
745 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the...
745 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.
751 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.
751 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users.
751 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests.
751 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft SharePoint contains a deserialization vulnerability that allows for remote code execution.
752 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of the parameters in an HTTP request. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious website.
753 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Microsoft Windows Kernel contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that could allow for privilege escalation.
759 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Mozilla Firefox and Firefox ESR contain a use-after-free vulnerability in Animation timelines that allows for code execution in the content process.
759 days since the last new exploitation evidence (evidence: , ENISA EUVD)
VMware ESXi contains an out-of-bounds write vulnerability. A malicious actor with privileges...
763 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability in the UHCI...
763 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
An arithmetic overflow flaw was found in Satellite when creating a new personal access token....
764 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)...
766 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.
779 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account.
784 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB...
793 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the UHCI USB...
793 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Linux kernel contains a position-independent executable (PIE) stack buffer corruption vulnerability in load_elf_ binary() that allows a local attacker to escalate privileges.
794 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
SonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the firewall to crash.
795 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution.
816 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests.
819 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.
835 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Defender SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.
842 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.
849 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability that may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
850 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Zemana AntiLogger v2.74.204.664 is vulnerable to an Arbitrary Process Termination vulnerability by triggering the 0x80002048 IOCTL code of the zam64.sys and zamguard64.sys drivers.
850 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Rejetto HTTP File Server contains an improper neutralization of special elements used in a template engine vulnerability. This allows a remote, unauthenticated attacker to execute commands on the affected system by sending a specially crafted HTTP request.
857 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Progress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements.
869 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823.
881 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Windows Error Reporting Service contains an improper privilege management vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges.
882 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Linux kernel contains a use-after-free vulnerability in the netfilter: nf_tables component that allows an attacker to achieve local privilege escalation.
883 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Check Point Quantum Security Gateways contain an unspecified information disclosure vulnerability. The vulnerability potentially allows an attacker to access information on Gateways connected to the internet, with IPSec VPN, Remote Access VPN or Mobile Access enabled. This issue affects several product lines from Check Point, including CloudGuard Network, Quantum Scalable Chassis, Quantum Security Gateways, and Quantum Spark Appliances.
897 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.
897 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
NextGen Healthcare Mirth Connect contains a deserialization of untrusted data vulnerability that allows for unauthenticated remote code execution via a specially crafted request.
906 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft DWM Core Library contains a privilege escalation vulnerability that allows an attacker to gain SYSTEM privileges.
912 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE.
921 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Microsoft SharePoint Server contains a code injection vulnerability that allows an authenticated attacker with Site Owner privileges to execute code remotely.
926 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
A remote command execution (RCE) vulnerability in NextGen Mirth Connect v4.3.0 allows attackers...
938 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall.
940 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) contains a code injection vulnerability that allows an unauthenticated user to execute malicious code with limited permissions (nobody).
963 days since the last new exploitation evidence (evidence: , ENISA EUVD)
JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions.
968 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
aiohttp is vulnerable to directory traversal
973 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation.
984 days since the last new exploitation evidence (evidence: , ENISA EUVD)
The 3DPrint Lite WordPress plugin before 1.9.1.5 does not have any authorisation and does not...
984 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
ConnectWise ScreenConnect contains an authentication bypass vulnerability that allows an attacker with network access to the management interface to create a new, administrator-level account on affected devices.
993 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Exchange Server allows for server-side request forgery. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41082 which allows for remote code execution.
994 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via...
995 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a security feature bypass.
996 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations.
1002 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution.
1003 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated attacker to execute code or commands via specially crafted HTTP requests.
1008 days since the last new exploitation evidence (evidence: , ENISA EUVD)
The Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to conduct clickjacking attacks via a (1) FRAME or (2) IFRAME element.
1009 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing...
1009 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Denial of Service in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN...
1009 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) vulnerability in the SAML component that allows an attacker to access certain restricted resources without authentication.
1017 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller. An attacker who successfully exploits the vulnerability could run a specially crafted application on a device on the network. The vulnerability is also known under the moniker of Zerologon.
1018 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Windows Print Spooler contains an unspecified vulnerability due to the Windows Print Spooler service improperly performing privileged file operations. Successful exploitation allows an attacker to perform remote code execution with SYSTEM privileges. The vulnerability is also known under the moniker of PrintNightmare.
1024 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the web component that allows an attacker to access restricted resources by bypassing control checks. This vulnerability can be leveraged in conjunction with CVE-2024-21887, a command injection vulnerability.
1038 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web components of these products, which can allow an authenticated administrator to send crafted requests to execute code on affected appliances. This vulnerability can be leveraged in conjunction with CVE-2023-46805, an authenticated bypass issue.
1038 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.
1040 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.
1040 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
An authenticated attacker could leverage improper validation in cmdlet arguments within Microsoft Exchange and perform remote code execution.
1045 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of system.
1057 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Veritas Backup Exec (BE) Agent contains a file access vulnerability that could allow an attacker to specially craft input parameters on a data management protocol command to access files on the BE Agent machine.
1057 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Veritas Backup Exec (BE) Agent contains an improper authentication vulnerability that could allow an attacker unauthorized access to the BE Agent via SHA authentication scheme.
1057 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Veritas Backup Exec (BE) Agent contains a command execution vulnerability that could allow an attacker to use a data management protocol command to execute a command on the BE Agent machine.
1057 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.
1057 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint.
1057 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution.
1057 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Windows Print Spooler contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges.
1057 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a Deadbolt ransomware campaign.
1057 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
dotCMS ContentResource API contains an unrestricted upload of file with a dangerous type vulnerability that allows for directory traversal, in which the file is saved outside of the intended storage location. Exploitation allows for remote code execution.
1057 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
JetBrains TeamCity contains an authentication bypass vulnerability that allows for remote code execution on TeamCity Server.
1066 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence.
1070 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Windows Search contains an unspecified vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file, leading to remote code execution.
1070 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Netwrix Auditor User Activity Video Recording component contains an insecure objection deserialization vulnerability that allows an unauthenticated, remote attacker to execute code as the NT AUTHORITY\SYSTEM user. Successful exploitation requires that the attacker is able to reach port 9004/TCP, which is commonly blocked by standard enterprise firewalling.
1070 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.
1072 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Qlik Sense contains a path traversal vulnerability that allows a remote, unauthenticated attacker to create an anonymous session by sending maliciously crafted HTTP requests. This anonymous session could allow the attacker to send further requests to unauthorized endpoints.
1072 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that enables Nacos servers to bypass this filter and therefore skip authentication checks. This mechanism relies on the user-agent HTTP header so it can be easily spoofed. This issue may allow any user to carry out any administrative tasks on the Nacos server.
1078 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
SysAid Server (on-premises version) contains a path traversal vulnerability that leads to code execution.
1096 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
1122 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Zyxel EMG2926 routers contain a command injection vulnerability located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute malicious commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI.
1152 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or establish a clientless SSL VPN session with an unauthorized user.
1157 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Type confusion in V8 in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to...
1165 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content. These are fixed versions of the DLL drop-in: 2020.1.10 (12.1.10), 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3).
1171 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
RARLAB WinRAR contains an unspecified vulnerability that allows an attacker to execute code when a user attempts to view a benign file within a ZIP archive.
1177 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Ivanti Endpoint Manager Mobile (EPMM, previously branded MobileIron Core) contains an authentication bypass vulnerability that allows unauthenticated access to specific API paths. An attacker with access to these API paths can access personally identifiable information (PII) such as names, phone numbers, and other mobile device details for users on a vulnerable system. An attacker can also make other configuration changes including installing software and modifying security profiles on registered devices.
1204 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Citrix NetScaler ADC and NetScaler Gateway contains a code injection vulnerability that allows for unauthenticated remote code execution.
1213 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests.
1249 days since the last new exploitation evidence (evidence: , ENISA EUVD)
In Progress MOVEit Transfer before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022...
1259 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
A post-authentication arbitrary file read vulnerability impacting end-of-life Secure Remote Access (SRA) products and older firmware versions of Secure Mobile Access (SMA) 100 series products, specifically the SRA appliances running all 8.x, 9.0.0.5-19sv and earlier versions and Secure Mobile Access (SMA) 100 series products running older firmware 9.0.0.9-26sv and earlier versions
1278 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.
1368 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Stack consumption vulnerability in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 7.0 allows remote authenticated users to cause a denial of service (daemon crash) via a list (ls) -R command containing a wildcard that references a subdirectory, followed by a .. (dot dot), aka "IIS FTP Service DoS Vulnerability."
1368 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol (RAKP)...
1368 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie...
1368 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
IBM API Connect 5.0.0.0 through 5.0.8.4 is affected by a vulnerability in the role-based access control in the management server that could allow an authenticated user to obtain highly sensitive information. IBM X-Force ID: 153175.
1368 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other...
1368 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
<p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account.</p> <p>Exploitation of this vulnerability requires that a user uploads a specially crafted SharePoint application package to an affected version of SharePoint.</p> <p>The security update addresses the vulnerability by correcting how SharePoint checks the source markup of application packages.</p>
1368 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Boa 0.94.13 allows remote attackers to obtain sensitive information via a misconfiguration...
1368 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.
1368 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Intel ethernet diagnostics driver for Windows IQVW32.sys and IQVW64.sys contain an unspecified vulnerability that allows for a denial-of-service (DoS).
1369 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Fortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remote code execution vulnerability in the License Response Servlet due to deserializing an attacker-controlled object.
1372 days since the last new exploitation evidence (evidence: , ENISA EUVD)
OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5...
1379 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Telerik UI for ASP.NET AJAX contains an insecure direct object reference vulnerability in RadAsyncUpload that can result in file uploads in a limited location and/or remote code execution.
1387 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.
1390 days since the last new exploitation evidence (evidence: , ENISA EUVD)
A local privilege escalation (LPE) issue was discovered in the ransomware canaries features of...
1396 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Windows SMB Remote Code Execution Vulnerability
1396 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Unauthorized access to Gateway user capabilities
1400 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
The socket connection handler in aswArPot.sys in the Avast and AVG Windows Anti Rootkit driver...
1439 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
The socket connection handler in aswArPot.sys in the Avast and AVG Windows Anti Rootkit driver before 22.1 allows local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) due to a double fetch vulnerability at aswArPot+0xbb94.
1439 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Windows Print Spooler Elevation of Privilege Vulnerability
1444 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Windows Spoofing Vulnerability
1460 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
The GDrv low-level driver in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.
1478 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.
1478 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.
1478 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.
1478 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. An attacker with valid credentials on Windows would be able to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks.
1481 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Cisco AnyConnect Secure Mobility Client for Windows interprocess communication (IPC) channel allows for insufficient validation of resources that are loaded by the application at run time. An attacker with valid credentials on Windows could execute code on the affected machine with SYSTEM privileges.
1481 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Improper authentication in Veeam Backup & Replication 9.5U3, 9.5U4,10.x and 11.x component used for Microsoft System Center Virtual Machine Manager (SCVMM) allows attackers execute arbitrary code via Veeam.Backup.PSManager.exe
1481 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
A remote code execution vulnerability exists in Microsoft Exchange server due to improper...
1484 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to upload arbitrary files using cpio package to gain incorrect access to any other user accounts.
1485 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.
1494 days since the last new exploitation evidence (evidence: , ENISA EUVD)
The driver in Micro-Star MSI Afterburner 4.6.2.15658 (aka RTCore64.sys and RTCore32.sys) allows...
1501 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.
1521 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Fortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test request to a rogue LDAP server.
1527 days since the last new exploitation evidence (evidence: , ENISA EUVD)
WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows an attacker to perform shellcode execution. This vulnerability impacts web browsers using WebRTC including but not limited to Google Chrome.
1541 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained with CVE-2022-37042 which allows for unauthenticated remote code execution.
1555 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Synacor Zimbra Collaboration Suite (ZCS) contains an authentication bypass vulnerability in MailboxImportServlet. This vulnerability was chained with CVE-2022-27925 which allows for unauthenticated remote code execution.
1555 days since the last new exploitation evidence (evidence: , ENISA EUVD)
RARLAB UnRAR on Linux and UNIX contains a directory traversal vulnerability, allowing an attacker to write to files during an extract (unpack) operation.
1557 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to inject memcache commands into a targeted instance which causes an overwrite of arbitrary cached entries.
1558 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
1596 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Unauthenticated access to the JBoss Application Server Web Console (/web-console) is blocked by default. However, it was found that this block was incomplete, and only blocked GET and POST HTTP verbs. A remote attacker could use this flaw to gain access to sensitive information.
1596 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Silverlight does not properly validate pointers during HTML object rendering, which allows remote attackers to execute code via a crafted Silverlight application.
1596 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Silverlight mishandles negative offsets during decoding, which allows attackers to execute remote code or cause a denial-of-service (DoS).
1596 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
ConnectWise ManagedITSync integration for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database.
1596 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Microsoft Update Notification Manager contains an unspecified vulnerability that allows for privilege escalation.
1596 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Designer.
1598 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle allows remote attackers to bypass the Java security sandbox.
1598 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.
1600 days since the last new exploitation evidence (evidence: , ENISA EUVD)
The Service Appliance component in Mitel MiVoice Connect allows remote code execution due to incorrect data validation.
1600 days since the last new exploitation evidence (evidence: , ENISA EUVD)
An information disclosure vulnerability exists in the way that certain functions in Internet Explorer and Edge handle objects in memory. The vulnerability could allow an attacker to detect specific files on the user's computer.
1604 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
FileZen (V3.0.0 to V4.2.7 and V5.0.0 to V5.0.2) allows a remote attacker with administrator...
1605 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
A vulnerability in the Universal Plug-and-Play (UPnP) service of Cisco Small Business RV110W,...
1605 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application.
1613 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Windows Common Log File System Driver Elevation of Privilege Vulnerability
1614 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
The JBoss Application Server, shipped with Red Hat Enterprise Application Platform 5.2, allows an attacker to execute arbitrary code via crafted serialized data.
1619 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.
1626 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands.
1626 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.
1626 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
A privilege escalation vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links.
1627 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
A privilege escalation vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.
1627 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none
1640 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3. A remote attacker may be able to leak memory.
1640 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that might allow remote attackers to inject arbitrary web script or HTML.
1669 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Kaseya VSA RMM allows unprivileged remote attackers to execute PowerShell payloads on all managed devices.
1674 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site.
1674 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Remote Procedure Call Runtime Remote Code Execution Vulnerability. This CVE ID is unique from CVE...
1674 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.
1677 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
A directory traversal vulnerability exists in the administrator console in Adobe ColdFusion which allows remote attackers to read arbitrary files.
1694 days since the last new exploitation evidence (evidence: , ENISA EUVD)
When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
1694 days since the last new exploitation evidence (evidence: , ENISA EUVD)
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance is accessible by anonymous users and can be abused to perform remote code execution.
1694 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Spring Data Commons contains a property binder vulnerability which can allow an attacker to perform remote code execution.
1694 days since the last new exploitation evidence (evidence: , ENISA EUVD)
An issue was discovered in Webmin. The parameter old in password_change.cgi contains a command injection vulnerability.
1694 days since the last new exploitation evidence (evidence: , ENISA EUVD)
A command injection vulnerability has been reported to affect certain versions of Malware Remover. If exploited, this vulnerability allows remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Malware Remover versions prior to 4.6.1.0. This issue does not affect: QNAP Systems Inc. Malware Remover 3.x.
1695 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
The kernel-mode driver in Microsoft Windows OS and Server allows local users to gain privileges via a crafted application.
1704 days since the last new exploitation evidence (evidence: , ENISA EUVD)
A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory.
1704 days since the last new exploitation evidence (evidence: , ENISA EUVD)
A privilege escalation vulnerability exists in the way the Task Scheduler Service validates certain file operations.
1704 days since the last new exploitation evidence (evidence: , ENISA EUVD)
A privilege escalation vulnerability exists when the Windows UPnP service improperly allows COM object creation.
1704 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability that allows for information disclosure.
1708 days since the last new exploitation evidence (evidence: , CISA Vulnrichment)
Unspecified vulnerability in Adobe Reader and Acrobat allows attackers to cause a denial of service or possibly execute arbitrary code.
1716 days since the last new exploitation evidence (evidence: , ENISA EUVD)
An incorrect type vulnerability exists in the Concurrency component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.
1716 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Hotspot.
1716 days since the last new exploitation evidence (evidence: , ENISA EUVD)
The Java Runtime Environment (JRE) component in Oracle Java SE allow for remote code execution.
1716 days since the last new exploitation evidence (evidence: , ENISA EUVD)
An unspecified vulnerability exists in the Win32k.sys kernel-mode driver in Microsoft Windows Server that allows a local attacker to execute arbitrary code with elevated privileges.
1716 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Adobe Flash Player allows remote attackers to cause a denial of service or possibly execute arbitrary code.
1716 days since the last new exploitation evidence (evidence: , ENISA EUVD)
An access of resource using incompatible type vulnerability exists within Adobe Flash Player that allows an attacker to perform remote code execution.
1716 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability in the Calendar feature that allows an attacker to execute arbitrary code.
1722 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Apache httpd allows remote attackers to read secret data from process memory if the Limit...
1725 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Adobe Flash Player com.adobe.tvsdk.mediacore.metadata Use After Free Vulnerability
1732 days since the last new exploitation evidence (evidence: , ENISA EUVD)
WinRAR Absolute Path Traversal vulnerability leads to Remote Code Execution
1732 days since the last new exploitation evidence (evidence: , ENISA EUVD)
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution"
1732 days since the last new exploitation evidence (evidence: , ENISA EUVD)
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer
1732 days since the last new exploitation evidence (evidence: , ENISA EUVD)
The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.
1737 days since the last new exploitation evidence (evidence: , ENISA EUVD)
The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.
1737 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Oracle Corporation WebLogic Server contains a vulnerability that allows for remote code execution.
1737 days since the last new exploitation evidence (evidence: , ENISA EUVD)
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.
1737 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.
1743 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Microsoft Windows BITS is vulnerable to to a privilege elevation vulnerability if it improperly handles symbolic links. An actor can exploit this vulnerability to execute arbitrary code with system-level privileges.
1750 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Cross-site scripting (XSS) vulnerability in Views in the Ubercart module 7.x-3.x before 7.x-3.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via the full name field.
1752 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Cross-site request forgery (CSRF) vulnerability in Lifecycle Query Engine (LQE) in IBM Jazz...
1752 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
In CPUID CPU-Z through 1.81, there are improper access rights to a kernel-mode driver (e.g.,...
1752 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Unquoted Search Path in Maxthon 5.1.0 to 5.2.7 Browser for Windows.
1752 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
An exploitable command execution vulnerability exists in the ASN1 certificate writing...
1752 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Microsoft Windows Win32k contains a vulnerability that allows an attacker to escalate privileges.
1757 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials.
1760 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021...
1761 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k EoP.
1768 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled.
1768 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).
1768 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.
1787 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability.
1794 days since the last new exploitation evidence (evidence: , ENISA EUVD)
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
1808 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in the wp-content/plugins directory.
1823 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Microsoft Win32k kernel-mode driver fails to properly handle objects in memory which allows for privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.
1836 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Citrix Workspace Application and Receiver for Windows contains remote code execution vulnerability resulting from local drive access preferences not being enforced into the clients' local drives.
1836 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an unspecified vulnerability that could allow an unauthenticated attacker to perform code execution.
1836 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Fortinet FortiOS contains a default configuration vulnerability that may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the Lightweight Directory Access Protocol (LDAP) server.
1836 days since the last new exploitation evidence (evidence: , ENISA EUVD)
SonicWall SMA100 contains a SQL injection vulnerability allowing an unauthenticated user to gain read-only access to unauthorized resources.
1836 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the case in their username.
1836 days since the last new exploitation evidence (evidence: , ENISA EUVD)
VMware ESXi OpenSLP contains a use-after-free vulnerability that allows an attacker residing in the management network with access to port 427 to perform remote code execution.
1836 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Microsoft Windows Print Spooler contains an unspecified vulnerability that allows for remote code execution.
1836 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.
1836 days since the last new exploitation evidence (evidence: , ENISA EUVD)
SonicWall SSLVPN SMA100 contains a SQL injection vulnerability that allows remote exploitation for credential access by an unauthenticated attacker.
1836 days since the last new exploitation evidence (evidence: , ENISA EUVD)
SonicWall Email Security contains an improper privilege management vulnerability that allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20022 and CVE-2021-20023 to achieve privilege escalation.
1836 days since the last new exploitation evidence (evidence: , ENISA EUVD)
SonicWall Email Security contains an unrestricted upload of file with dangerous type vulnerability that allows a post-authenticated attacker to upload a file to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20023 to achieve privilege escalation.
1836 days since the last new exploitation evidence (evidence: , ENISA EUVD)
SonicWall Email Security contains a path traversal vulnerability that allows a post-authenticated attacker to read files on the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20022 to achieve privilege escalation.
1836 days since the last new exploitation evidence (evidence: , ENISA EUVD)
VMware vCenter Server vSphere Client contains a remote code execution vulnerability in a vCenter Server plugin which allows an attacker with network access to port 443 to execute commands with unrestricted privileges on the underlying operating system.
1836 days since the last new exploitation evidence (evidence: , ENISA EUVD)
VMware vSphere Client contains an improper input validation vulnerability in the Virtual SAN Health Check plug-in, which is enabled by default in vCenter Server, which allows for remote code execution.
1836 days since the last new exploitation evidence (evidence: , ENISA EUVD)
GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files.
1836 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Ivanti Pulse Connect Secure contains a use-after-free vulnerability that allow a remote, unauthenticated attacker to execute code via license services.
1836 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Microsoft Internet Explorer contains an unspecified vulnerability that allows for memory corruption.
1836 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.
1836 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.
1836 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.
1836 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.
1836 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Kaseya Virtual System/Server Administrator (VSA) contains an information disclosure vulnerability allowing an attacker to obtain the sessionId that can be used to execute further attacks against the system.
1836 days since the last new exploitation evidence (evidence: , ENISA EUVD)
Microsoft MSHTML contains a unspecified vulnerability that allows for remote code execution.
1836 days since the last new exploitation evidence (evidence: , ENISA EUVD)
An information disclosure vulnerability exists when the Windows RDP client improperly discloses the contents of its memory, aka 'Remote Desktop Protocol Client Information Disclosure Vulnerability'.
1912 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
An information disclosure vulnerability exists when the Windows RDP server improperly discloses...
1912 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
An information disclosure vulnerability exists when the Windows RDP server improperly discloses...
1912 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
An information disclosure vulnerability exists in Remote Desktop Protocol (RDP) when an attacker...
1912 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021...
1914 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or...
1934 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Authenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp is insecurely returned in the requested web page and can be used to perform a Cross Site Scripting attack Example request: `https://x.x.x.x/HelpDeskTab/rcResults.asp?result=<script>alert(document.cookie)</script>` The same is true for the parameter FileName of /done.asp Eaxmple request: `https://x.x.x.x/done.asp?FileName=";</script><script>alert(1);a="&PathData=&originalName=shell.aspx&FileSize=4388&TimeElapsed=00:00:00.078`
1956 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Kaseya VSA through 9.5.7 allows attackers to bypass the 2FA requirement.
1956 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
A authentication bypass and execution of code vulnerability in HPE Integrated Lights-out 4 (iLO 4...
2041 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
An unprivileged Windows user on the VDA can perform arbitrary command execution as SYSTEM in CVAD...
2117 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
An unprivileged Windows user on the VDA or an SMB user can perform arbitrary command execution as...
2117 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
An authorised user on a Windows host running Citrix Universal Print Server can perform arbitrary...
2117 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Remote Command Execution (RCE) vulnerability in TerraMaster TOS <= 4.2.06 allow remote...
2124 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).
2202 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Cross-site scripting (XSS) vulnerability in editor.php in Network Weathermap before 0.97b allows remote attackers to inject arbitrary web script or HTML via the map_title parameter.
2220 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Adobe Acrobat and Reader versions 2018.011.20055 and earlier, 2017.011.30096 and earlier, and...
2220 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
A remote code execution vulnerability exists in the way that the scripting engine handles objects...
2220 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath...
2234 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
An Elevation of Privilege vulnerability exists when Cortana retrieves data from user input services without consideration for status, aka "Cortana Elevation of Privilege Vulnerability." This affects Windows 10 Servers, Windows 10.
2234 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification process. This flaw also allows the bypass of Secure Boot protections. In order to load an untrusted or modified kernel, an attacker would first need to establish access to the system such as gaining physical access, obtain the ability to alter a pxe-boot network, or have remote access to a networked system with root access. With this access, an attacker could then craft a string to cause a buffer overflow by injecting a malicious payload that leads to arbitrary code execution within GRUB. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
2234 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side.
2308 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.
2308 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred.
2308 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Laravel Framework Deserialization Vulnerability
2333 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
In Pulse Secure Pulse Connect Secure (PCS) 8.3.x before 8.3R7.1 and 9.0.x before 9.0R3, an XSS issue has been found on the Application Launcher page.
2349 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Buffer overflow in the WriteGROUP4Image function in coders/tiff.c in ImageMagick before 6.9.5-8...
2453 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does...
2453 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code execution. This attack appear to be exploitable via an app which allows execution of 3rd party code AND disallows node integration AND has not specified if webview is enabled/disabled. This vulnerability appears to have been fixed in 1.7.13, 1.8.4, 2.0.0-beta.4.
2453 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage...
2453 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4.
2453 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Bluetooth firmware or operating system software drivers in macOS versions before 10.13, High Sierra and iOS versions before 11.4, and Android versions before the 2018-06-05 patch may not sufficiently validate elliptic curve parameters used to generate public keys during a Diffie-Hellman key exchange, which may allow a remote attacker to obtain the encryption key used by the device.
2453 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
The Linux kernel, versions 3.9+, is vulnerable to a denial of service attack with low rates of...
2453 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus,...
2453 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0642.
2487 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
A remote code execution vulnerability exists when Internet Explorer improperly accesses objects...
2487 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to...
2487 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
A remote code execution vulnerability exists in Microsoft Excel software when the software fails...
2487 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
A remote code execution vulnerability exists in Microsoft Excel software when the software fails...
2487 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka 'Microsoft Office Memory Corruption Vulnerability'.
2487 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
A remote code execution vulnerability exists in Microsoft Excel software when the software fails...
2487 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when...
2495 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when...
2495 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote Desktop Client Remote Code Execution Vulnerability'.
2495 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Remote code execution in PATCH requests in Spring Data REST
2734 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent:...
2753 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent:...
2866 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 do not require authentication by default in certain profiles, which might allow remote attackers to invoke MBean methods and execute arbitrary code via unspecified vectors. NOTE: this issue can only be exploited when the interceptor is not properly configured with a "second layer of authentication," or when used in conjunction with other vulnerabilities that bypass this second layer.
3152 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Elaborate Bytes ElbyCDIO.sys 6.0.2.0 and earlier, as distributed in SlySoft AnyDVD before 6.5.2.6, Virtual CloneDrive 5.4.2.3 and earlier, CloneDVD 2.9.2.0 and earlier, and CloneCD 5.3.1.3 and earlier, uses the METHOD_NEITHER communication method for IOCTLs and does not properly validate a buffer associated with the Irp object, which allows local users to cause a denial of service (system crash) via a crafted IOCTL call.
3174 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
sandra.sys 15.18.1.1 and earlier in the Sandra Device Driver in SiSoftware Sandra 16.10.2010.1 and earlier allows local users to gain privileges or cause a denial of service (system crash) via unspecified vectors involving "Model-Specific Registers."
3174 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
ZyXEL PK5001Z devices have zyad5001 as the su password, which makes it easier for remote...
3276 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold and SP2, and Windows 7 RC allows remote attackers to execute arbitrary code or cause a denial of service (system crash) via an & (ampersand) character in a Process ID High header field in a NEGOTIATE PROTOCOL REQUEST packet, which triggers an attempted dereference of an out-of-bounds memory location, aka "SMBv2 Negotiation Vulnerability." NOTE: some of these details are obtained from third party information.
3433 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
GIGABYTE BRIX UEFI firmware for the GB-BSi7H-6500 (version F6) and GB-BXi7-5775 (version F2)...
3514 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
GIGABYTE BRIX UEFI firmware does not cryptographically validate images prior to updating the...
3514 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Integer overflow in Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on...
3622 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
The default configuration of the deployment descriptor (aka web.xml) in picketlink-sts.war in (1) the security_saml quickstart, (2) the webservice_proxy_security quickstart, (3) the web-console application, (4) the http-invoker application, (5) the gpd-deployer application, (6) the jbpm-console application, (7) the contract application, and (8) the uddi-console application in JBoss Enterprise SOA Platform before 5.0.2 contains GET and POST http-method elements, which allows remote attackers to bypass intended access restrictions via a crafted HTTP request.
3885 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Cross-site request forgery (CSRF) vulnerability in the JMX Console (jmx-console) in JBoss Enterprise Portal Platform before 5.2.2, BRMS Platform 5.3.0 before roll up patch1, and SOA Platform 5.3.0 allows remote authenticated users to hijack the authentication of arbitrary users for requests that perform operations on MBeans and possibly execute arbitrary code via unspecified vectors.
3885 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
AutoFORM PDM Archive before 7.0 implements user accounts in a way that allows for JMX Console authentication, which allows remote authenticated users to bypass intended access restrictions via the /jmx-console URI, and then upload and execute arbitrary JSP code via a JBoss remote-deployment mechanism, a different vulnerability than CVE-2012-1828.
3885 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Cross-site request forgery (CSRF) vulnerability in the Web Console (web-console) in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application Server) before 2.0.0.CR9 allows remote attackers to hijack the authentication of administrators for requests that make arbitrary changes to an instance via vectors involving a file upload using a multipart/form-data submission.
3885 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Heap-based buffer overflow in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0...
3979 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X...
4155 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X...
4168 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0...
4405 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Buffer overflow in Adobe Flash Player before 11.7.700.279 and 11.8.x through 13.0.x before 13.0.0...
4581 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and...
5002 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Adobe Flash Player before 10.3.183.51 and 11.x before 11.5.502.149 on Windows and Mac OS X,...
5026 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
The default configuration of JBoss does not restrict access to the (1) console and (2) web management interfaces, which allows remote attackers to bypass authentication and gain administrative access via direct requests.
5687 days since the last new exploitation evidence (evidence: , VulnCheck KEV)
Membership: a CVE's known-ransomware-campaign-use flag, read from the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog where the CVE is listed there and from VulnCheck's KEV catalog where it is not, together with this tracker's own stored active-exploitation status. The statistics page counts only CISA's flag, so compare it with the CISA count above, not with the total. Evidence dates come from CISA KEV, CISA Vulnrichment, VulnCheck KEV, and the European Union Agency for Cybersecurity (ENISA) EU Vulnerability Database, whichever authority reported exploitation of this CVE most recently.