cve.bz

Matching records, newest first, page 110

Filter
  1. 9.8CVE-2013-0803ExploitEPSS 75%

    A PHP File Upload Vulnerability exists in PolarBear CMS 2.5 via upload.php, which could let a malicious user execute arbitrary code.

  2. 9.8CVE-2013-1360ExploitEPSS 23%

    An Authentication Bypass vulnerability exists in DELL SonicWALL Global Management System (GMS) 4.1, 5.0, 5.1, 6.0, and 7.0, Analyzer 7.0, Universal Management Appliance (UMA) 5.1, 6.0, and 7.0 and ViewPoint 4.1, 5.0, and 6.0 via a crafted …

  3. 7.8CVE-2014-8347ExploitEPSS 1.4%

    An Authentication Bypass vulnerability exists in the MatchPasswordData function in DBEngine.dll in Filemaker Pro 13.03 and Filemaker Pro Advanced 12.04, which could let a malicious user obtain elevated privileges.

  4. 9.8CVE-2013-5945ExploitEPSS 9.8%

    Multiple SQL injection vulnerabilities in D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44; and DSR-500, DSR-500N, DSR-1000, and DSR-1000N with firmware b…

  5. 5.4CVE-2013-2108ExploitEPSS 2.2%

    WordPress WP Cleanfix Plugin 2.4.4 has CSRF

  6. 8.8CVE-2014-5086ExploitEPSS 9.8%

    A Command Execution vulnerability exists in Sphider Pro, and Sphider Plus 3.2 due to insufficient sanitization of fwrite to conf.php, which could let a remote malicious user execute arbitrary code. CVE-2014-5086 pertains to instances of fw…

  7. 8.8CVE-2014-5085ExploitEPSS 5.8%

    A Command Execution vulnerability exists in Sphider Plus 3.2 due to insufficient sanitization of fwrite to conf.php, which could let a remote malicious user execute arbitrary code. CVE-2014-5085 pertains to instances of fwrite in Sphider P…

  8. 8.8CVE-2014-5084ExploitEPSS 7.7%

    A Command Execution vulnerability exists in Sphider Pro 3.2 due to insufficient sanitization of fwrite, which could let a remote malicious user execute arbitrary code. CVE-2014-5084 pertains to instances of fwrite in Sphider Pro only, but …

  9. 8.8CVE-2014-5083ExploitEPSS 5.8%

    A Command Execution vulnerability exists in Sphider before 1.3.6 due to insufficient sanitization of fwrite to conf.php, which could let a remote malicious user execute arbitrary code. CVE-2014-5083 pertains to instances of fwrite in Sphid…

  10. 5.4CVE-2020-8825ExploitEPSS 1.9%

    index.php?p=/dashboard/settings/branding in Vanilla 2.6.3 allows stored XSS.

  11. 8.8CVE-2012-4512ExploitEPSS 12%

    The CSS parser (khtml/css/cssparser.cpp) in Konqueror in KDE 4.7.3 allows remote attackers to cause a denial of service (crash) and possibly read memory via a crafted font face source, related to "type confusion."

  12. 9.8CVE-2014-8739ExploitEPSS 92%

    Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and b…

  13. 7.5CVE-2014-7863ExploitEPSS 83%

    The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and earlier does not properly restrict access, which allows remote …

  14. 8.8CVE-2014-2225ExploitEPSS 1.3%

    Multiple cross-site request forgery (CSRF) vulnerabilities in Ubiquiti Networks UniFi Controller before 3.2.1 allow remote attackers to hijack the authentication of administrators for requests that (1) create a new admin user via a request…

  15. 9.6CVE-2011-3642ExploitEPSS 8.8%

    Cross-site scripting (XSS) vulnerability in Flowplayer Flash 3.2.7 through 3.2.16, as used in the News system (news) extension for TYPO3 and Mahara, allows remote attackers to inject arbitrary web script or HTML via the plugin configuratio…

  16. 9.8CVE-2014-5091ExploitEPSS 15%

    A vulnerability exits in Status2K 2.5 Server Monitoring Software via the multies parameter to includes/functions.php, which could let a malicious user execute arbitrary PHP code.

  17. 9.8CVE-2014-5087ExploitEPSS 7.2%

    A vulnerability exists in Sphider Search Engine prior to 1.3.6 due to exec calls in admin/spiderfuncs.php, which could let a remote malicious user execute arbitrary code.

  18. 8.8CVE-2014-5468ExploitEPSS 53%

    A File Inclusion vulnerability exists in Railo 4.2.1 and earlier via a specially-crafted URL request to the thumbnail.cfm to specify a malicious PNG file, which could let a remote malicious user obtain sensitive information or execute arbi…

  19. 8.8CVE-2014-5288ExploitEPSS 1.6%

    A CSRF Vulnerability exists in Kemp Load Master before 7.0-18a via unspecified vectors in administrative pages.

  20. 7.0CVE-2019-18988KEVExploitEPSS 4.7%

    TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for different customers' installations. It used a shared AES key for all installations since at least as far back as v7.0.4314…

  21. 8.8CVE-2013-3629ExploitEPSS 43%

    ISPConfig 3.0.5.2 has Arbitrary PHP Code Execution

  22. 8.8CVE-2013-3628ExploitEPSS 67%

    Zabbix 2.0.9 has an Arbitrary Command Execution Vulnerability

  23. 8.8CVE-2013-3591ExploitEPSS 43%

    vTiger CRM 5.3 and 5.4: 'files' Upload Folder Arbitrary PHP Code Execution Vulnerability

  24. 8.8CVE-2013-2009ExploitEPSS 16%

    WordPress WP Super Cache Plugin 1.2 has Remote PHP Code Execution

  25. 4.9CVE-2013-0192ExploitEPSS 3.8%

    File Disclosure in SMF (SimpleMachines Forum) <= 2.0.3: Forum admin can read files such as the database config.

  26. 9.8CVE-2020-8656ExploitEPSS 85%

    An issue was discovered in EyesOfNetwork 5.3. The EyesOfNetwork API 2.4.2 is prone to SQL injection, allowing an unauthenticated attacker to perform various tasks such as authentication bypass via the username field to getApiKey in include…

  27. 7.8CVE-2020-8655KEVExploitEPSS 60%

    An issue was discovered in EyesOfNetwork 5.3. The sudoers configuration is prone to a privilege escalation vulnerability, allowing the apache user to run arbitrary commands as root via a crafted NSE script for nmap 7.

  28. 8.8CVE-2020-8654ExploitEPSS 91%

    An issue was discovered in EyesOfNetwork 5.3. An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS commands via the /module/module_frame/index.php autodiscovery.php target field.

  29. 8.8CVE-2013-3568ExploitEPSS 25%

    Cross-site request forgery (CSRF) vulnerability in Cisco Linksys WRT110 allows remote attackers to hijack the authentication of users for requests that have unspecified impact via unknown vectors.

  30. 6.1CVE-2013-2684ExploitEPSS 3.7%

    Cross-site Scripting (XSS) in Cisco Linksys E4200 1.0.05 Build 7 devices allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  31. 5.3CVE-2013-2683ExploitEPSS 13%

    Cisco Linksys E4200 1.0.05 Build 7 devices contain an Information Disclosure Vulnerability which allows remote attackers to obtain private IP addresses and other sensitive information.

  32. 9.8CVE-2020-8657KEVExploitEPSS 92%

    An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded as EONAPI_KEY in include/api_functions.php for API version 2.4.2) by default for all installations, hence allowing an attacker to calculate/gue…

  33. 8.8CVE-2012-6307ExploitEPSS 5.6%

    A vulnerability exists in JPEGsnoop 1.5.2 due to an unspecified issue in JPEG file handling, which could let a malicious user execute arbitrary code

  34. 9.8CVE-2020-8772ExploitEPSS 88%

    The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php. Any attacker who knows the username of an administrator can log in.

  35. 9.8CVE-2020-8771ExploitEPSS 46%

    The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWP_JSON_PREFIX causes the client to be logged in as the first account on the list of administrator accounts.

  36. 8.8CVE-2014-2030ExploitEPSS 11%

    Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick, possibly 6.8.8-5, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PSD image, involving…

  37. 8.8CVE-2015-6000ExploitEPSS 40%

    Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.3.0 and earlier allows remote authenticated users to execute arbitrary …

  38. 6.1CVE-2012-2593ExploitEPSS 6.2%

    Cross-site scripting (XSS) vulnerability in the administrative interface in Atmail Webmail Server 6.4 allows remote attackers to inject arbitrary web script or HTML via the Date field of an email.

  39. 9.8CVE-2020-8644KEVExploitEPSS 86%

    PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.

  40. 8.8CVE-2020-8641ExploitEPSS 12%

    Lotus Core CMS 1.0.1 allows authenticated Local File Inclusion of .php files via directory traversal in the index.php page_slug parameter.

  41. 4.3CVE-2013-2682ExploitEPSS 6.3%

    Cisco Linksys E4200 1.0.05 Build 7 devices contain a Clickjacking Vulnerability which allows remote attackers to obtain sensitive information.

  42. 9.8CVE-2013-2681ExploitEPSS 10%

    Cisco Linksys E4200 1.0.05 Build 7 devices contain a Security Bypass Vulnerability which could allow remote attackers to gain unauthorized access.

  43. 7.5CVE-2013-2680ExploitEPSS 8.7%

    Cisco Linksys E4200 1.0.05 Build 7 devices store passwords in cleartext allowing remote attackers to obtain sensitive information.

  44. 4.8CVE-2019-15253ExploitEPSS 3.1%

    A vulnerability in the web-based management interface of Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based ma…

  45. 3.1CVE-2019-15126ExploitEPSS 7.3%

    An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors (related to state transitions) in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent…

  46. 6.5CVE-2020-8615ExploitEPSS 11%

    A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions (such as blocking legitimate instructors).

  47. 6.1CVE-2020-8115ExploitEPSS 7.0%

    A reflected XSS vulnerability has been discovered in the publicly accessible afr.php delivery script of Revive Adserver <= 5.0.3 by Jacopo Tediosi. There are currently no known exploits: the session identifier cannot be accessed as it is s…

  48. 8.1CVE-2013-2678ExploitEPSS 17%

    Cisco Linksys E4200 1.0.05 Build 7 routers contain a Local File Include Vulnerability which could allow remote attackers to obtain sensitive information or execute arbitrary code by sending a crafted URL request to the apply.cgi script usi…

  49. 9.8CVE-2013-7055ExploitEPSS 7.0%

    D-Link DIR-100 4.03B07 has PPTP and poe information disclosure

  50. 6.1CVE-2013-7054ExploitEPSS 3.5%

    D-Link DIR-100 4.03B07: cli.cgi XSS