cve.bz

OWASP A08:2025 Software or Data Integrity Failures vulnerabilities, newest first, page 101

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A08:2025 at MITRE.

Its weaknesses: 14

CWE-345, CWE-353, CWE-426, CWE-427, CWE-494, CWE-502, CWE-506, CWE-509, CWE-565, CWE-784, CWE-829, CWE-830, CWE-915, CWE-926

  1. 8.8CVE-2023-27298EPSS 0.7%

    Uncontrolled search path in the WULT software maintained by Intel(R) before version 1.0.0 (commit id 592300b) may allow an unauthenticated user to potentially enable escalation of privilege via network access.

  2. 7.8CVE-2023-22355EPSS 0.2%

    Uncontrolled search path in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.0.251 may allow an authenticated user to potentially enable escalation of privilege via local access.

  3. 7.8CVE-2022-43474EPSS 0.2%

    Uncontrolled search path for the DSP Builder software installer before version 22.4 for Intel(R) FPGAs Pro Edition may allow an authenticated user to potentially enable escalation of privilege via local access.

  4. 7.8CVE-2022-41998EPSS 0.2%

    Uncontrolled search path in the Intel(R) DCM software before version 5.1 may allow an authenticated user to potentially enable escalation of privilege via local access.

  5. 7.8CVE-2022-41982EPSS 0.2%

    Uncontrolled search path element in the Intel(R) VTune(TM) Profiler software before version 2023.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

  6. 7.8CVE-2022-41693EPSS 0.2%

    Uncontrolled search path in the Intel(R) Quartus(R) Prime Pro edition software before version 22.3 may allow an authenticated user to potentially enable escalation of privilege via local access.

  7. 7.8CVE-2022-41628EPSS 0.2%

    Uncontrolled search path element in the HotKey Services for some Intel(R) NUC P14E Laptop Element software for Windows 10 before version 1.1.44 may allow an authenticated user to potentially enable escalation of privilege via local access.

  8. 7.8CVE-2022-38101EPSS 0.2%

    Uncontrolled search path in some Intel(R) NUC Chaco Canyon BIOS update software before version iFlashV Windows 5.13.00.2105 may allow an authenticated user to potentially enable escalation of privilege via local access.

  9. 7.8CVE-2022-34848EPSS 0.2%

    Uncontrolled search path for the Intel(R) NUC Pro Software Suite before version 2.0.0.3 may allow an authenticated user to potentially enable escalation of privilege via local access.

  10. 7.8CVE-2022-32576EPSS 0.2%

    Uncontrolled search path in the Intel(R) Unite(R) Plugin SDK before version 4.2 may allow an authenticated user to potentially enable escalation of privilege via local access.

  11. 7.8CVE-2022-27180EPSS 0.2%

    Uncontrolled search path in the Intel(R) MacCPUID software before version 3.2 may allow an authenticated user to potentially enable escalation of privilege via local access.

  12. 7.3CVE-2022-21162EPSS 0.2%

    Uncontrolled search path for the Intel(R) HDMI Firmware Update tool for NUC before version 1.79.1.1 may allow an authenticated user to potentially enable escalation of privilege via local access.

  13. 5.3CVE-2023-28317EPSS 0.2%

    A vulnerability has been discovered in Rocket.Chat, where editing messages can change the original timestamp, causing the UI to display messages in an incorrect order.

  14. 8.8CVE-2023-30899EPSS 1.1%

    A vulnerability has been identified in Siveillance Video 2020 R2 (All versions < V20.2 HotfixRev14), Siveillance Video 2020 R3 (All versions < V20.3 HotfixRev12), Siveillance Video 2021 R1 (All versions < V21.1 HotfixRev12), Siveillance Vi…

  15. 8.8CVE-2023-30898EPSS 1.1%

    A vulnerability has been identified in Siveillance Video 2020 R2 (All versions < V20.2 HotfixRev14), Siveillance Video 2020 R3 (All versions < V20.3 HotfixRev12), Siveillance Video 2021 R1 (All versions < V21.1 HotfixRev12), Siveillance Vi…

  16. 7.8CVE-2023-30237EPSS 0.4%

    CyberGhostVPN Windows Client before v8.3.10.10015 was discovered to contain a DLL injection vulnerability via the component Dashboard.exe.

  17. 6.5CVE-2022-4537EPSS 0.3%

    The Hide My WP Ghost – Security Plugin plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.0.18. This is due to insufficient restrictions on where the IP Address information is being retrieved for …

  18. 5.5CVE-2022-44420EPSS 0.07%

    In modem, there is a possible missing verification of HashMME value in Security Mode Command. This could local denial of service with no additional execution privileges.

  19. 9.8CVE-2023-1650EPSS 34%

    The AI ChatBot WordPress plugin before 4.4.7 unserializes user input from cookies via an AJAX action available to unauthenticated users, which could allow them to perform PHP Object Injection when a suitable gadget is present on the blog

  20. 7.2CVE-2023-1347EPSS 16%

    The Customizer Export/Import WordPress plugin before 0.9.6 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present

  21. 8.8CVE-2023-2551EPSS 1.9%

    PHP Remote File Inclusion in GitHub repository unilogies/bumsys prior to 2.1.1.

  22. 4.6CVE-2023-21486EPSS 0.2%

    Improper export of android application components vulnerability in ImagePreviewActivity in Call Settings to SMR May-2023 Release 1 allows physical attackers to access some media data stored in sandbox.

  23. 4.6CVE-2023-21485EPSS 0.2%

    Improper export of android application components vulnerability in VideoPreviewActivity in Call Settings to SMR May-2023 Release 1 allows physical attackers to access some media data stored in sandbox.

  24. 8.8CVE-2023-1196EPSS 1.1%

    The Advanced Custom Fields (ACF) Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, which could allow users with a role of Contributor and above to perform PHP Object Injection when a …

  25. 7.2CVE-2023-1669EPSS 18%

    The SEOPress WordPress plugin before 6.5.0.3 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.

  26. 9.8CVE-2023-1967EPSS 0.8%

    Keysight N8844A Data Analytics Web Service deserializes untrusted data without sufficiently verifying the resulting data will be valid.

  27. 7.8CVE-2023-2355EPSS 0.2%

    Local privilege escalation due to a DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy (Windows) before build 3900.

  28. 9.8CVE-2023-20853EPSS 1.0%

    aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ asynchronized message process. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands to perf…

  29. 9.8CVE-2023-20852EPSS 1.0%

    aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ interpreter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands to perform arbitrary syst…

  30. 7.8CVE-2023-29012EPSS 0.4%

    Git for Windows is the Windows port of Git. Prior to version 2.40.1, any user of Git CMD who starts the command in an untrusted directory is impacted by an Uncontrolles Search Path Element vulnerability. Maliciously-placed `doskey.exe` wou…

  31. 7.8CVE-2023-29011EPSS 0.4%

    Git for Windows, the Windows port of Git, ships with an executable called `connect.exe`, which implements a SOCKS5 proxy that can be used to connect e.g. to SSH servers via proxies when certain ports are blocked for outgoing connections. T…

  32. 8.8CVE-2023-2141EPSS 1.0%

    An unsafe .NET object deserialization in DELMIA Apriso Release 2017 through Release 2022 could lead to post-authentication remote code execution.

  33. 9.8CVE-2023-20864ExploitEPSS 70%

    VMware Aria Operations for Logs contains a deserialization vulnerability. An unauthenticated, malicious actor with network access to VMware Aria Operations for Logs may be able to execute arbitrary code as root.

  34. 8.8CVE-2022-46302EPSS 0.4%

    Broad access controls could allow site users to directly interact with the system Apache installation when providing the reverse proxy configurations for Tribe29's Checkmk <= 2.1.0p6, Checkmk <= 2.0.0p27, and all versions of Checkmk 1.6.0 …

  35. 9.8CVE-2021-28254EPSS 1.3%

    A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows attackers to execute arbitrary commands.

  36. 6.7CVE-2022-34755EPSS 0.2%

    A CWE-427 - Uncontrolled Search Path Element vulnerability exists that could allow an attacker with a local privileged account to place a specially crafted file on the target machine, which may give the attacker the ability to execute arbi…

  37. 7.0CVE-2023-28143EPSS 0.2%

    Qualys Cloud Agent for macOS (versions 2.5.1-75 before 3.7) installer allows a local escalation of privilege bounded only to the time of installation and only on older macOSX (macOS 10.15 and older) versions. Attackers may exploit incorrec…

  38. 7.0CVE-2023-28140EPSS 0.2%

    An Executable Hijacking condition exists in the Qualys Cloud Agent for Windows platform in versions before 4.5.3.1. Attackers may load a malicious copy of a Dependency Link Library (DLL) via a local attack vector instead of the DLL that th…

  39. 9.1CVE-2023-28863EPSS 0.4%

    AMI MegaRAC SPx12 and SPx13 devices have Insufficient Verification of Data Authenticity.

  40. 6.5CVE-2023-24503EPSS 0.2%

    Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW.

  41. 6.5CVE-2023-24500EPSS 0.2%

    Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW.

  42. 5.3CVE-2023-2042EPSS 1.1%

    A vulnerability, which was classified as problematic, has been found in DataGear up to 4.7.0/5.1.0. Affected by this issue is some unknown functionality of the component JDBC Server Handler. The manipulation leads to deserialization. The a…

  43. 9.8CVE-2023-27748EPSS 0.7%

    BlackVue DR750-2CH LTE v.1.012_2022.10.26 does not employ authenticity check for uploaded firmware. This can allow attackers to upload crafted firmware which contains backdoors and enables arbitrary code execution.

  44. 7.8CVE-2023-22635EPSS 0.1%

    A download of code without Integrity check vulnerability [CWE-494] in FortiClientMac version 7.0.0 through 7.0.7, 6.4 all versions, 6.2 all versions, 6.0 all versions, 5.6 all versions, 5.4 all versions, 5.2 all versions, 5.0 all versions…

  45. 7.8CVE-2023-1552EPSS 0.2%

    ToolboxST prior to version 7.10 is affected by a deserialization vulnerability. An attacker with local access to an HMI or who has conducted a social engineering attack on an authorized operator could execute code in a Toolbox user's conte…

  46. 6.7CVE-2023-29187EPSS 0.2%

    A Windows user with basic user authorization can exploit a DLL hijacking attack in SapSetup (Software Installation Program) - version 9.0, resulting in a privilege escalation running code as administrator of the very same Windows PC. A suc…

  47. 5.4CVE-2023-26467EPSS 0.6%

    A man in the middle can redirect traffic to a malicious server in a compromised configuration.

  48. 8.8CVE-2023-1381EPSS 1.7%

    The WP Meta SEO WordPress plugin before 4.5.5 does not validate image file paths before attempting to manipulate the image files, leading to a PHAR deserialization vulnerability. Furthermore, the plugin contains a gadget chain which may be…

  49. 9.8CVE-2023-29216EPSS 2.1%

    In Apache Linkis <=1.3.1, because the parameters are not effectively filtered, the attacker uses the MySQL data source and malicious parameters to configure a new data source to trigger a deserialization vulnerability, eventually leading t…

  50. 9.8CVE-2023-29215EPSS 2.1%

    In Apache Linkis <=1.3.1, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in JDBC EengineConn Module will trigger a deserialization vulnerability and eventually lead to remote c…