cve.bz

Matching records, newest first, page 111

Filter
  1. 8.8CVE-2013-7053ExploitEPSS 3.4%

    D-Link DIR-100 4.03B07: cli.cgi CSRF

  2. 9.8CVE-2013-7052ExploitEPSS 25%

    D-Link DIR-100 4.03B07: security bypass via an error in the cliget.cgi script

  3. 8.8CVE-2013-7051ExploitEPSS 16%

    D-Link DIR-100 4.03B07: cli.cgi security bypass due to failure to check authentication parameters

  4. 9.8CVE-2012-5686ExploitEPSS 4.8%

    ZPanel 10.0.1 has insufficient entropy for its password reset process.

  5. 7.5CVE-2019-16893ExploitEPSS 38%

    The Web Management of TP-Link TP-SG105E V4 1.0.0 Build 20181120 devices allows an unauthenticated attacker to reboot the device via a reboot.cgi request.

  6. 9.8CVE-2020-8547ExploitEPSS 5.9%

    phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters.

  7. 5.3CVE-2013-2624ExploitEPSS 6.5%

    Telean before 1.3.1 contains a full path disclosure vulnerability which could allow remote attackers to obtain sensitive information through a specially crafted URL request.

  8. 6.1CVE-2013-2623ExploitEPSS 2.8%

    Cross-site Scripting (XSS) in Telaen before 1.3.1 allows remote attackers to inject arbitrary web script or HTML via the "f_email" parameter in index.php.

  9. 6.1CVE-2013-2621ExploitEPSS 11%

    Open Redirection Vulnerability in the redir.php script in Telaen before 1.3.1 allows remote attackers to redirect victims to arbitrary websites via a crafted URL.

  10. 9.8CVE-2020-8515KEVExploitEPSS >99.9%

    DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. T…

  11. 6.1CVE-2020-8512ExploitEPSS 15%

    In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter.

  12. 6.5CVE-2020-8505ExploitEPSS 1.1%

    School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=deleteadmin CSRF to delete a user.

  13. 6.5CVE-2020-8504ExploitEPSS 1.1%

    School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=addadmin CSRF to add an administrative user.

  14. 9.8CVE-2014-8322ExploitEPSS 24%

    Stack-based buffer overflow in the tcp_test function in aireplay-ng.c in Aircrack-ng before 1.2 RC 1 allows remote attackers to execute arbitrary code via a crafted length parameter value.

  15. 8.8CVE-2014-3868ExploitEPSS 2.5%

    Multiple SQL injection vulnerabilities in ZeusCart 4.x.

  16. 8.8CVE-2014-3119ExploitEPSS 1.7%

    Multiple SQL injection vulnerabilities in web2Project 3.1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) search_string parameter in the contacts module to index.php or allow remote attackers to e…

  17. 7.5CVE-2020-8495ExploitEPSS 3.1%

    In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H491delegate servlet allows an attacker with Timekeeper or Supervisor privileges to gain unauthorized administrative privileges within…

  18. 4.8CVE-2020-8493ExploitEPSS 1.5%

    A stored XSS vulnerability in Kronos Web Time and Attendance (webTA) affects 3.8.x and later 3.x versions before 4.0 via multiple input fields (Login Message, Banner Message, and Password Instructions) of the com.threeis.webta.H261configMe…

  19. 6.1CVE-2013-4241ExploitEPSS 3.7%

    Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) image, (3) url, or (4) testimonial parameter…

  20. 6.1CVE-2013-2294ExploitEPSS 4.0%

    Multiple cross-site scripting (XSS) vulnerabilities in ViewGit before 0.0.7 allow remote repository users to inject arbitrary web script or HTML via a (1) tag name to the Shortlog table in templates/shortlog.php or branch name to the (2) S…

  21. 7.5CVE-2013-0291ExploitEPSS 16%

    NextGEN Gallery Plugin for WordPress 1.9.10 and 1.9.11 has a Path Disclosure Vulnerability

  22. 6.1CVE-2013-3320ExploitEPSS 2.3%

    Cross-site Scripting (XSS) vulnerability in NetApp OnCommand System Manager before 2.2 allows remote attackers to inject arbitrary web script or HTML via the 'full-name' and 'comment' fields.

  23. 7.5CVE-2013-2574ExploitEPSS 30%

    An Access vulnerability exists in FOSCAM IP Camera FI8620 due to insufficient access restrictions in the /tmpfs/ and /log/ directories, which could let a malicious user obtain sensitive information.

  24. 9.8CVE-2013-2573ExploitEPSS 42%

    A Command Injection vulnerability exists in the ap parameter to the /cgi-bin/mft/wireless_mft.cgi file in TP-Link IP Cameras TL-SC 3130, TL-SC 3130G, 3171G. and 4171G 1.6.18P12s, which could let a malicious user execute arbitrary code.

  25. 7.5CVE-2013-2572ExploitEPSS 16%

    A Security Bypass vulnerability exists in TP-LINK IP Cameras TL-SC 3130, TL-SC 3130G, 3171G, 4171G, and 3130 1.6.18P12 due to default hard-coded credentials for the administrative Web interface, which could let a malicious user obtain unau…

  26. 7.8CVE-2019-18634ExploitEPSS 19%

    In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the defau…

  27. 9.8CVE-2013-3215ExploitEPSS 69%

    vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due to improper authentication validation in the validateSession function.

  28. 9.8CVE-2013-2570ExploitEPSS 27%

    A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 in the General.Time.NTP.Server parameter to the sub_C8C8 function of the binary /opt/cgi/view/param, which could let a remove malicious user execute arbitrary code.

  29. 7.5CVE-2013-2569ExploitEPSS 31%

    A Security Bypass vulnerability exists in Zavio IP Cameras through 1.6.3 because the RTSP protocol authentication is disabled by default, which could let a malicious user obtain unauthorized access to the live video stream.

  30. 9.8CVE-2013-2568ExploitEPSS 49%

    A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 via the ap parameter to /cgi-bin/mft/wireless_mft.cgi, which could let a remote malicious user execute arbitrary code.

  31. 7.5CVE-2020-8416ExploitEPSS 14%

    IKTeam BearFTP before 0.2.0 allows remote attackers to achieve denial of service via a large volume of connections to the PASV mode port.

  32. 7.5CVE-2013-2567ExploitEPSS 15%

    An Authentication Bypass vulnerability exists in the web interface in Zavio IP Cameras through 1.6.03 due to a hardcoded admin account found in boa.conf, which lets a remote malicious user obtain sensitive information.

  33. 9.8CVE-2020-7247KEVExploitEPSS 99%

    smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM f…

  34. 5.4CVE-2020-2103ExploitEPSS 7.0%

    Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI diagnostic page.

  35. 5.4CVE-2013-0161ExploitEPSS 1.0%

    Havalite CMS 1.1.7 has a stored XSS vulnerability

  36. 9.8CVE-2019-20215ExploitEPSS 75%

    D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because HTTP_ST is mishandled. The value of the urn: service/device is…

  37. 6.5CVE-2020-8425ExploitEPSS 1.2%

    Cups Easy (Purchase & Inventory) 1.0 is vulnerable to CSRF that leads to admin account deletion via userdelete.php.

  38. 8.8CVE-2020-8424ExploitEPSS 1.5%

    Cups Easy (Purchase & Inventory) 1.0 is vulnerable to CSRF that leads to admin account takeover via passwordmychange.php.

  39. 5.3CVE-2013-1603ExploitEPSS 16%

    An Authentication vulnerability exists in D-LINK WCS-1100 1.02, TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS-7510 1.00, DCS-7410 1.00, DCS-6410 1.00, DCS-5635 1.01, DCS-5605 1.01, DCS-5230L 1.02, DCS-5230 1.02, DCS-3430 1.02, …

  40. 7.5CVE-2013-1602ExploitEPSS 15%

    An Information Disclosure vulnerability exists due to insufficient validation of authentication cookies for the RTSP session in D-Link DCS-5635 1.01, DCS-1100L 1.04, DCS-1130L 1.04, DCS-1100 1.03/1.04_US, DCS-1130 1.03/1.04_US , DCS-2102 1…

  41. 9.8CVE-2013-3214ExploitEPSS 85%

    vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'.

  42. 8.1CVE-2013-3212ExploitEPSS 7.5%

    vtiger CRM 5.4.0 and earlier contain local file-include vulnerabilities in 'customerportal.php' which allows remote attackers to view files and execute local script code.

  43. 5.3CVE-2013-1601ExploitEPSS 12%

    An Information Disclosure vulnerability exists due to a failure to restrict access on the lums.cgi script when processing a live video stream in D-LINK An Information Disclosure vulnerability exists due to a failure to restrict access on t…

  44. 5.3CVE-2013-1600ExploitEPSS 19%

    An Authentication Bypass vulnerability exists in upnp/asf-mp4.asf when streaming live video in D-Link TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS-2121 1.06_FR, 1.06, and 1.05_RU, DCS-2102 1.06_FR. 1.06, and 1.05_RU, which cou…

  45. 9.8CVE-2013-2748ExploitEPSS 13%

    Belkin Wemo Switch before WeMo_US_2.00.2176.PVT could allow remote attackers to upload arbitrary files onto the system.

  46. 6.1CVE-2013-2714ExploitEPSS 2.7%

    Cross-site Scripting (XSS) in WordPress podPress Plugin 8.8.10.13 could allow remote attackers to inject arbitrary web script or html via the 'playerID' parameter.

  47. 9.8CVE-2013-1599ExploitEPSS 40%

    A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd.cgi script in D-Link IP Cameras DCS-3411/3430 firmware 1.02, DCS-5605/5635 1.01, DCS-1100L/1130L 1.04, DCS-1100/1130 1.03, DCS-1100/1130 1.04_US, DCS-2102/2121 1.05_RU, …

  48. 6.5CVE-2013-4865ExploitEPSS 1.7%

    Cross-site request forgery (CSRF) vulnerability in upgrade_step2.sh in MiCasaVerde VeraLite with firmware 1.5.408 allows remote attackers to hijack the authentication of users for requests that install arbitrary firmware via the squashfs p…

  49. 9.8CVE-2013-4864ExploitEPSS 6.3%

    MiCasaVerde VeraLite with firmware 1.5.408 allows remote attackers to send HTTP requests to intranet servers via the url parameter to cgi-bin/cmh/proxy.sh, related to a Server-Side Request Forgery (SSRF) issue.

  50. 8.8CVE-2013-4863ExploitEPSS 12%

    The HomeAutomationGateway service in MiCasaVerde VeraLite with firmware 1.5.408 allows (1) remote attackers to execute arbitrary Lua code via a RunLua action in a request to upnp/control/hag on port 49451 or (2) remote authenticated users …