cve.bz

Matching records, newest first, page 109

Filter
  1. 6.1CVE-2014-9608ExploitEPSS 4.7%

    Cross-site scripting (XSS) vulnerability in webadmin/policy/group_table_ajax.php/ in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.

  2. 6.1CVE-2014-9607ExploitEPSS 4.9%

    Cross-site scripting (XSS) vulnerability in remotereporter/load_logfiles.php in Netsweeper 4.0.3 and 4.0.4 allows remote attackers to inject arbitrary web script or HTML via the url parameter.

  3. 6.1CVE-2014-9606ExploitEPSS 4.2%

    Multiple cross-site scripting (XSS) vulnerabilities in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) server parameter to remotereporter/load_l…

  4. 7.8CVE-2012-0055ExploitEPSS 1.2%

    OverlayFS in the Linux kernel before 3.0.0-16.28, as used in Ubuntu 10.0.4 LTS and 11.10, is missing inode security checks which could allow attackers to bypass security restrictions and perform unauthorized actions.

  5. 9.8CVE-2020-7796KEVExploitEPSS 94%

    Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.

  6. 9.8CVE-2015-7567ExploitEPSS 3.7%

    SQL injection vulnerability in Yeager CMS 1.2.1 allows remote attackers to execute arbitrary SQL commands via the "passwordreset&token" parameter.

  7. 6.1CVE-2013-2679ExploitEPSS 20%

    Multiple cross-site scripting (XSS) vulnerabilities in Cisco Linksys E4200 router with firmware 1.0.05 build 7 allow remote attackers to inject arbitrary web script or HTML via the (1) log_type, (2) ping_ip, (3) ping_size, (4) submit_type,…

  8. 9.8CVE-2015-6970ExploitEPSS 5.3%

    The web interface in Bosch Security Systems NBN-498 Dinion2X Day/Night IP Cameras with H.264 Firmware 4.54.0026 allows remote attackers to conduct XML injection attacks via the idstring parameter to rcp.xml.

  9. 9.8CVE-2020-8012ExploitEPSS 77%

    CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains a buffer overflow vulnerability in the robot (controller) component. A remote attacker can execute arbitrary code.

  10. 9.8CVE-2020-8010ExploitEPSS 51%

    CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains an improper ACL handling vulnerability in the robot (controller) component. A remote attacker can execute commands, read from, or write to the tar…

  11. 9.1CVE-2014-7236ExploitEPSS 56%

    Eval injection vulnerability in lib/TWiki/Plugins.pm in TWiki before 6.0.1 allows remote attackers to execute arbitrary Perl code via the debugenableplugins parameter to do/view/Main/WebHome.

  12. 7.8CVE-2014-1947ExploitEPSS 7.0%

    Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick 6.5.4 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of layers in a P…

  13. 9.8CVE-2015-6922ExploitEPSS 82%

    Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before 9.1.0.9 does not properly require authentication, which allows remote attackers to bypass authentication and (1) add an…

  14. 8.8CVE-2020-9043ExploitEPSS 7.4%

    The wpCentral plugin before 1.5.1 for WordPress allows disclosure of the connection key.

  15. 5.4CVE-2020-9038ExploitEPSS 3.6%

    Joplin through 1.0.184 allows Arbitrary File Read via XSS.

  16. 9.8CVE-2020-8518ExploitEPSS 72%

    Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code execution.

  17. 9.8CVE-2013-4211ExploitEPSS 71%

    A Code Execution Vulnerability exists in OpenX Ad Server 2.8.10 due to a backdoor in flowplayer-3.1.1.min.js library, which could let a remote malicious user execute arbitrary PHP code

  18. 8.8CVE-2015-6589ExploitEPSS 14%

    Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33, 8..0.0.0 before 8.0.0.23, 9.0.0.0 before 9.0.0.19, and 9.1.0.0 before 9.1.0.9 allows remote authenticated users to write to and execute…

  19. 9.8CVE-2014-4170ExploitEPSS 14%

    A Privilege Escalation Vulnerability exists in Free Reprintables ArticleFR 11.06.2014 due to insufficient access restrictions in the data.php script, which could let a remote malicious user obtain access or modify or delete database inform…

  20. 5.4CVE-2012-1500ExploitEPSS 1.1%

    Stored XSS vulnerability in UpdateFieldJson.jspa in JIRA 4.4.3 and GreenHopper before 5.9.8 allows an attacker to inject arbitrary script code.

  21. 9.8CVE-2020-7209ExploitEPSS 99%

    LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2.

  22. 7.8CVE-2019-18915ExploitEPSS 1.5%

    A potential security vulnerability has been identified with certain versions of HP System Event Utility prior to version 1.4.33. This vulnerability may allow a local attacker to execute arbitrary code via an HP System Event Utility system …

  23. 9.8CVE-2011-4908ExploitEPSS 56%

    TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php.

  24. 9.8CVE-2011-4906ExploitEPSS 9.6%

    Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution.

  25. 7.5CVE-2011-3336ExploitEPSS 6.5%

    regcomp in the BSD implementation of libc is vulnerable to denial of service due to stack exhaustion.

  26. 7.2CVE-2020-8947ExploitEPSS 22%

    functions_netflow.php in Artica Pandora FMS 7.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the index.php?operation/netflow/nf_live_view ip_dst, dst_port, or src_port parameter, a different vulnerab…

  27. 6.1CVE-2013-2637ExploitEPSS 4.3%

    A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items, and FAQ articles, which could let a remote malicious user execute arbitrary code.

  28. 9.8CVE-2013-6236ExploitEPSS 10%

    IZON IP 2.0.2: hard-coded password vulnerability

  29. 7.8CVE-2013-2097ExploitEPSS 26%

    ZPanel through 10.1.0 has Remote Command Execution

  30. 6.1CVE-2013-1938ExploitEPSS 3.3%

    Zimbra 2013 has XSS in aspell.php

  31. 6.1CVE-2020-8839ExploitEPSS 2.1%

    Stored XSS was discovered on CHIYU BF-430 232/485 TCP/IP Converter devices before 1.16.00, as demonstrated by the /if.cgi TF_submask field.

  32. 5.5CVE-2015-7890ExploitEPSS 1.3%

    Multiple buffer overflows in the esa_write function in /dev/seirenin the Exynos Seiren Audio driver, as used in Samsung S6 Edge, allow local users to cause a denial of service (memory corruption) via a large (1) buffer or (2) size paramete…

  33. 9.8CVE-2013-2010ExploitEPSS 74%

    WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability

  34. 6.1CVE-2013-1410ExploitEPSS 1.5%

    Perforce P4web 2011.1 and 2012.1 has multiple XSS vulnerabilities

  35. 7.5CVE-2014-2560ExploitEPSS 1.7%

    The PhonerLite phone before 2.15 provides hashed credentials in a response to an invalid authentication challenge, which makes it easier for remote attackers to obtain access via a brute-force attack, related to a "SIP Digest Leak" issue.

  36. 9.8CVE-2014-9390ExploitEPSS 76%

    Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; lib…

  37. 8.8CVE-2014-4968ExploitEPSS 6.2%

    The WebView class and use of the WebView.addJavascriptInterface method in the Boat Browser application 8.0 and 8.0.1 for Android allow remote attackers to execute arbitrary code via a crafted web site, a related issue to CVE-2012-6636.

  38. 9.8CVE-2014-2595ExploitEPSS 17%

    Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication token obtained from a query string.

  39. 8.8CVE-2020-0688KEVExploitEPSS >99.9%

    A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.

  40. 7.8CVE-2020-0683KEVExploitEPSS 7.7%

    An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka 'Windows Installer Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0686.

  41. 7.5CVE-2020-0674KEVExploitEPSS 87%

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0673, CVE-2020-07…

  42. 7.8CVE-2020-0668ExploitEPSS 26%

    An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0669, CVE-2020-0670, CVE-2020-0671,…

  43. 8.8CVE-2020-0618KEVExploitEPSS 99.0%

    A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.

  44. 6.1CVE-2012-2517ExploitEPSS 1.9%

    Cross-site scripting (XSS) vulnerability in PrestaShop before 1.4.9 allows remote attackers to inject arbitrary web script or HTML via the index of the product[] parameter to ajax.php.

  45. 6.1CVE-2012-2452ExploitEPSS 1.7%

    Multiple cross-site scripting (XSS) vulnerabilities in pragmaMx 1.x before 1.12.2 allow remote attackers to inject arbitrary web script or HTML via the (1) name parameter to modules.php or (2) img_url to includes/wysiwyg/spaw/editor/plugin…

  46. 9.8CVE-2012-1124ExploitEPSS 4.3%

    SQL injection vulnerability in search.php in phxEventManager 2.0 beta 5 allows remote attackers to execute arbitrary SQL commands via the search_terms parameter.

  47. 7.8CVE-2013-5582ExploitEPSS 3.6%

    Ammyy Admin 3.2 and earlier stores the client ID at a fixed memory location, which might make it easier for user-assisted remote attackers to bypass authentication by running a local program that extracts a field from the AA_v3.2.exe file.

  48. 6.8CVE-2009-4067ExploitEPSS 2.1%

    Buffer overflow in the auerswald_probe function in the Auerswald Linux USB driver for the Linux kernel before 2.6.27 allows physically proximate attackers to execute arbitrary code, cause a denial of service via a crafted USB device, or ta…

  49. 9.8CVE-2013-3684ExploitEPSS 19%

    NextGEN Gallery plugin before 1.9.13 for WordPress: ngggallery.php file upload

  50. 9.8CVE-2013-1359ExploitEPSS 89%

    An Authentication Bypass Vulnerability exists in DELL SonicWALL Analyzer 7.0, Global Management System (GMS) 4.1, 5.0, 5.1, 6.0, and 7.0; Universal Management Appliance (UMA) 5.1, 6.0, and 7.0 and ViewPoint 4.1, 5.0, 5.1, and 6.0 via the s…