cve.bz

OWASP A08:2025 Software or Data Integrity Failures vulnerabilities, newest first, page 76

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A08:2025 at MITRE.

Its weaknesses: 14

CWE-345, CWE-353, CWE-426, CWE-427, CWE-494, CWE-502, CWE-506, CWE-509, CWE-565, CWE-784, CWE-829, CWE-830, CWE-915, CWE-926

  1. 8.6CVE-2024-9490EPSS 0.2%

    DLL hijacking vulnerabilities, caused by an uncontrolled search path in Silicon Labs (8-bit) IDE installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.

  2. 8.8CVE-2024-41739EPSS 0.5%

    IBM Cognos Dashboards 4.0.7 and 5.0.0 on Cloud Pak for Data could allow a remote attacker to perform unauthorized actions due to dependency confusion.

  3. 7.8CVE-2024-53588EPSS 0.2%

    A DLL hijacking vulnerability in iTop VPN v16.0 allows attackers to execute arbitrary code via placing a crafted DLL file into the path \ProgramData\iTop VPN\Downloader\vpn6.

  4. 5.3CVE-2024-55929EPSS 0.2%

    A mail spoofing vulnerability in Xerox Workplace Suite allows attackers to forge email headers, making it appear as though messages are sent from trusted sources.

  5. 7.7CVE-2024-52331EPSS 0.2%

    ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot.

  6. 9.8CVE-2025-23006KEVEPSS 27%

    Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote u…

  7. 2.5CVE-2024-42183EPSS 0.09%

    BigFix Patch Download Plug-ins are affected by an arbitrary file download vulnerability. It could allow a malicious operator to download files from arbitrary URLs without any proper validation or allowlist controls.

  8. 9.8CVE-2025-23914EPSS 0.6%

    Deserialization of Untrusted Data vulnerability in muzaara Muzaara Google Ads Report muzaara-adwords-optimize-dashboard allows Object Injection.This issue affects Muzaara Google Ads Report: from n/a through <= 3.1.

  9. 8.8CVE-2024-31903EPSS 1.0%

    IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.2 allow an attacker on the local network to execute arbitrary code on the system, caused by the deserialization of untrusted data.

  10. 8.8CVE-2025-23944EPSS 0.7%

    Deserialization of Untrusted Data vulnerability in bulktheme WOOEXIM wooexim allows Object Injection.This issue affects WOOEXIM: from n/a through <= 5.0.0.

  11. 9.8CVE-2025-23932EPSS 0.8%

    Deserialization of Untrusted Data vulnerability in Marko-M Quick Count quick-count allows Object Injection.This issue affects Quick Count: from n/a through <= 3.00.

  12. 7.2CVE-2025-0429EPSS 0.7%

    The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via deserialization of untrusted input from the $form['post_content'] variable through the wpaicg_export_a…

  13. 7.2CVE-2025-0428EPSS 0.7%

    The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via deserialization of untrusted input from the $form['post_content'] variable through the wpaicg_export_p…

  14. 8.8CVE-2024-49699EPSS 0.8%

    Deserialization of Untrusted Data vulnerability in reputeinfosystems ARPrice arprice allows Object Injection.This issue affects ARPrice: from n/a through <= 4.1.3.

  15. 9.8CVE-2024-49688EPSS 0.5%

    Deserialization of Untrusted Data vulnerability in reputeinfosystems ARPrice arprice allows Object Injection.This issue affects ARPrice: from n/a through <= 4.1.3.

  16. 8.8CVE-2024-10936EPSS 1.1%

    The String locator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.6 via deserialization of untrusted input in the 'recursive_unserialize_replace' function. This makes it possible for un…

  17. 7.2CVE-2025-0586EPSS 0.7%

    The a+HRD from aEnrich Technology has an Insecure Deserialization vulnerability, allowing remote attackers with database modification privileges and regular system privileges to perform arbitrary code execution.

  18. 2.0CVE-2024-13524EPSS 0.2%

    A vulnerability has been found in obsproject OBS Studio up to 30.0.2 on Windows and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to untrusted search path. The attack needs to…

  19. 2.0CVE-2025-0567EPSS 0.2%

    A vulnerability classified as problematic was found in Epic Games Launcher up to 17.2.1. This vulnerability affects unknown code in the library profapi.dll of the component Installer. The manipulation leads to untrusted search path. Attack…

  20. 8.7CVE-2025-21606EPSS 0.3%

    stats is a macOS system monitor in for the menu bar. The Stats application is vulnerable to a local privilege escalation due to the insecure implementation of its XPC service. The application registers a Mach service under the name `eu.exe…

  21. 7.4CVE-2025-21399EPSS 0.7%

    Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability

  22. 8.5CVE-2024-12703EPSS 0.3%

    CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote code execution on workstation when a non-admin authenticated user opens a malicious project file.

  23. 6.5CVE-2024-56515EPSS 0.7%

    Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. If SVG or JPEGXL thumbnailers are enabled (they are disabled by default), a user may upload a file which claims to be either of these types and …

  24. 3.3CVE-2024-55503EPSS 0.4%

    An issue in termius before v.9.9.0 allows a local attacker to execute arbitrary code via a crafted script to the DYLD_INSERT_LIBRARIES component.

  25. 3.3CVE-2024-53407EPSS 0.5%

    In Phiewer 4.1.0, a dylib injection leads to Command Execution which allow attackers to inject dylib file potentially leading to remote control and unauthorized access to sensitive user data.

  26. 8.4CVE-2024-48123EPSS 0.2%

    An issue in the USB Autorun function of HI-SCAN 6040i Hitrax HX-03-19-I allows attackers to execute arbitrary code via uploading a crafted script from a USB device.

  27. 8.8CVE-2020-8094EPSS 0.2%

    An untrusted search path vulnerability in testinitsigs.exe as used in Bitdefender Antivirus Free 2020 allows a low-privilege attacker to execute code as SYSTEM via a specially crafted DLL file.

  28. 9.1CVE-2024-57766EPSS 0.5%

    MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/editField.

  29. 9.1CVE-2024-57764EPSS 0.5%

    MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/add.

  30. 9.1CVE-2024-57763EPSS 0.5%

    MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/addField.

  31. 7.5CVE-2024-57762EPSS 0.5%

    MSFM before v2025.01.01 was discovered to contain a deserialization vulnerability via the pom.xml configuration file.

  32. 7.8CVE-2025-21127EPSS 0.3%

    Photoshop Desktop versions 25.12, 26.1 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could lead to arbitrary code execution. An attacker could manipulate the search path environment variable to point to…

  33. 9.0CVE-2024-49375EPSS 0.9%

    Open source machine learning framework. A vulnerability has been identified in Rasa that enables an attacker who has the ability to load a maliciously crafted model remotely into a Rasa instance to achieve Remote Code Execution. The prereq…

  34. 7.8CVE-2025-21365EPSS 1.0%

    Microsoft Office Remote Code Execution Vulnerability

  35. 7.8CVE-2025-21364EPSS 1.7%

    Microsoft Excel Security Feature Bypass Vulnerability

  36. 6.9CVE-2025-0465EPSS 0.9%

    A vulnerability was found in AquilaCMS 1.412.13. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/v2/categories. The manipulation of the argument PostBody.populate leads to deserializatio…

  37. 7.8CVE-2024-13163EPSS 9.2%

    Deserialization of untrusted data in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to achieve remote code execution. Local user interaction is req…

  38. 7.2CVE-2024-13158EPSS 3.4%

    An unbounded resource search path in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.

  39. 4.8CVE-2025-0459EPSS 0.2%

    A vulnerability, which was classified as problematic, has been found in libretro RetroArch up to 1.19.1 on Windows. Affected by this issue is some unknown functionality in the library profapi.dll of the component Startup. The manipulation …

  40. 7.8CVE-2025-0069EPSS 0.2%

    Due to DLL injection vulnerability in SAPSetup, an attacker with either local user privileges or with access to a compromised corporate user�s Windows account could gain higher privileges. With this, he could move laterally within the netw…

  41. 9.8CVE-2025-22777EPSS 0.9%

    Deserialization of Untrusted Data vulnerability in StellarWP GiveWP give allows Object Injection.This issue affects GiveWP: from n/a through <= 3.19.3.

  42. 9.8CVE-2024-12877EPSS 1.2%

    The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.2 via deserialization of untrusted input from the donation form like 'firstName'. T…

  43. 7.5CVE-2024-12627EPSS 0.6%

    The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.5 via deserialization of untrusted input from p…

  44. 6.6CVE-2024-13297EPSS 0.4%

    Deserialization of Untrusted Data vulnerability in Drupal Eloqua allows Object Injection.This issue affects Eloqua: from 7.X-* before 7.X-1.15.

  45. 6.6CVE-2024-13296EPSS 0.4%

    Deserialization of Untrusted Data vulnerability in Drupal Mailjet allows Object Injection.This issue affects Mailjet: from 0.0.0 before 4.0.1.

  46. 6.6CVE-2024-13295EPSS 0.4%

    Deserialization of Untrusted Data vulnerability in Drupal Node export allows Object Injection.This issue affects Node export: from 7.X-* before 7.X-3.3.

  47. 4.3CVE-2024-13288EPSS 0.4%

    Deserialization of Untrusted Data vulnerability in Drupal Monster Menus allows Object Injection.This issue affects Monster Menus: from 0.0.0 before 9.3.4, from 9.4.0 before 9.4.2.

  48. 7.2CVE-2025-22510EPSS 1.3%

    Deserialization of Untrusted Data vulnerability in kkarpieszuk WC Price History for Omnibus wc-price-history allows Object Injection.This issue affects WC Price History for Omnibus: from n/a through <= 2.1.4.

  49. 5.3CVE-2023-27531EPSS 0.5%

    There is a deserialization of untrusted data vulnerability in the Kredis JSON deserialization code

  50. 6.5CVE-2024-55459EPSS 0.2%

    An issue in keras 3.7.0 allows attackers to write arbitrary files to the user's machine via downloading a crafted tar file through the get_file function.