cve.bz

Matching records, newest first, page 113

Filter
  1. 5.4CVE-2020-7108ExploitEPSS 3.5%

    The LearnDash LMS plugin before 3.1.2 for WordPress allows XSS via the ld-profile search field.

  2. 6.1CVE-2020-7107ExploitEPSS 2.2%

    The Ultimate FAQ plugin before 1.8.30 for WordPress allows XSS via Display_FAQ to Shortcodes/DisplayFAQs.php.

  3. 7.2CVE-2009-5068ExploitEPSS 1.7%

    There is a file disclosure vulnerability in SMF (Simple Machines Forum) affecting versions through v2.0.3. On some configurations a SMF deployment is shared by several "co-admins" that are not trusted beyond the SMF deployment. This vulner…

  4. 9.8CVE-2020-2555KEVExploitEPSS 97%

    Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability…

  5. 9.8CVE-2020-2551KEVExploitEPSS 93%

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability …

  6. 7.5CVE-2019-16469ExploitEPSS 17%

    Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have an expression language injection vulnerability. Successful exploitation could lead to sensitive information disclosure.

  7. 9.8CVE-2005-4891ExploitEPSS 1.7%

    Simple Machine Forum (SMF) versions 1.0.4 and earlier have an SQL injection vulnerability that allows remote attackers to inject arbitrary SQL statements.

  8. 6.1CVE-2020-2096ExploitEPSS 93%

    Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerability.

  9. 9.8CVE-2015-7874ExploitEPSS 14%

    Buffer overflow in the chat server in KiTTY Portable 0.65.0.2p and earlier allows remote attackers to execute arbitrary code via a long nickname.

  10. 7.8CVE-2015-5466ExploitEPSS 1.1%

    Silicon Integrated Systems XGI WindowsXP Display Manager (aka XGI VGA Driver Manager and VGA Display Manager) 6.14.10.1090 allows local users to gain privileges via a crafted 0x96002404 IOCTL call.

  11. 7.8CVE-2015-7556ExploitEPSS 1.3%

    DeleGate 9.9.13 allows local users to gain privileges as demonstrated by the dgcpnod setuid program.

  12. 6.1CVE-2011-4336ExploitEPSS 7.7%

    Tiki Wiki CMS Groupware 7.0 has XSS via the GET "ajax" parameter to snarf_ajax.php.

  13. 7.5CVE-2012-1563ExploitEPSS 8.9%

    Joomla! before 2.5.3 allows Admin Account Creation.

  14. 9.8CVE-2020-0646KEVExploitEPSS 99.2%

    A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.

  15. 9.8CVE-2020-0610ExploitEPSS 68%

    A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Windows Remote Desktop Gateway …

  16. 9.8CVE-2020-0609ExploitEPSS 78%

    A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Windows Remote Desktop Gateway …

  17. 8.1CVE-2020-0601KEVExploitEPSS 89%

    A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious…

  18. 7.2CVE-2020-5509ExploitEPSS 5.8%

    PHPGurukul Car Rental Project v1.0 allows Remote Code Execution via an executable file in an upload of a new profile image.

  19. 7.8CVE-2013-7185ExploitEPSS 2.8%

    PotPlayer 1.5.40688: .avi File Memory Corruption

  20. 9.8CVE-2012-4750ExploitEPSS 8.9%

    A Code Execution vulnerability exists in the memcpy function when processing AMF requests in Ezhometech EzServer 7.0, which could let a remote malicious user execute arbitrary code or cause a Denial of Service

  21. 6.1CVE-2019-20210ExploitEPSS 3.2%

    The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Reflected XSS via a search query.

  22. 9.8CVE-2013-6225ExploitEPSS 27%

    LiveZilla 5.0.1.4 has a Remote Code Execution vulnerability

  23. 7.5CVE-2014-6039ExploitEPSS 69%

    ManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials Disclosure Vulnerability. Fixed version 10 Build 10000.

  24. 7.5CVE-2014-6038ExploitEPSS 73%

    Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database Information Disclosure Vulnerability. Fixed in EventLog Analyzer 10.0 Build 10000.

  25. 9.8CVE-2014-5381ExploitEPSS 7.1%

    Grand MA 300 allows a brute-force attack on the PIN.

  26. 7.5CVE-2014-5380ExploitEPSS 4.3%

    Grand MA 300 allows retrieval of the access PIN from sniffed data.

  27. 9.8CVE-2012-4284ExploitEPSS 70%

    A Privilege Escalation vulnerability exists in Viscosity 1.4.1 on Mac OS X due to a path name validation issue in the setuid-set ViscosityHelper binary, which could let a remote malicious user execute arbitrary code

  28. 7.8CVE-2019-18194ExploitEPSS 2.2%

    TotalAV 2020 4.14.31 has a quarantine flaw that allows privilege escalation. Exploitation uses an NTFS directory junction to restore a malicious DLL from quarantine into the system32 folder.

  29. 9.8CVE-2014-5093ExploitEPSS 3.8%

    Status2k does not remove the install directory allowing credential reset.

  30. 8.8CVE-2014-5092ExploitEPSS 7.1%

    Status2k allows Remote Command Execution in admin/options/editpl.php.

  31. 6.1CVE-2014-4561ExploitEPSS 3.8%

    The ultimate-weather plugin 1.0 for WordPress has XSS

  32. 8.8CVE-2013-6231ExploitEPSS 9.9%

    SpagoBI before 4.1 has Privilege Escalation via an error in the AdapterHTTP script

  33. 6.1CVE-2011-4595ExploitEPSS 2.4%

    Pretty-Link WordPress plugin 1.5.2 has XSS

  34. 9.8CVE-2014-5081ExploitEPSS 10%

    sphider prior to 1.3.6, sphider-pro prior to 3.2, and sphider-plus prior to 3.2 allow authentication bypass

  35. 9.8CVE-2020-6756ExploitEPSS 11%

    languageOptions.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows unauthenticated attackers to remotely execute code via the lang parameter.

  36. 8.8CVE-2020-5504ExploitEPSS 28%

    In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own username when creating queries to this page. An attacker must have a valid MySQ…

  37. 7.2CVE-2019-20183ExploitEPSS 7.8%

    uploadimage.php in Employee Records System 1.0 allows upload and execution of arbitrary PHP code because file-extension validation is only on the client side. The attacker can modify global.js to allow the .php extension.

  38. 7.5CVE-2012-3810ExploitEPSS 5.0%

    Samsung Kies before 2.5.0.12094_27_11 has registry modification.

  39. 7.5CVE-2012-3809ExploitEPSS 5.0%

    Samsung Kies before 2.5.0.12094_27_11 has arbitrary directory modification.

  40. 7.5CVE-2012-3808ExploitEPSS 5.0%

    Samsung Kies before 2.5.0.12094_27_11 has arbitrary file modification.

  41. 9.8CVE-2012-3807ExploitEPSS 32%

    Samsung Kies before 2.5.0.12094_27_11 has arbitrary file execution.

  42. 6.1CVE-2019-18859ExploitEPSS 2.4%

    Digi AnywhereUSB 14 allows XSS via a link for the Digi Page.

  43. 9.8CVE-2012-2226ExploitEPSS 7.4%

    Invision Power Board before 3.3.1 fails to sanitize user-supplied input which could allow remote attackers to obtain sensitive information or execute arbitrary code by uploading a malicious file.

  44. 6.1CVE-2012-1915ExploitEPSS 1.9%

    EllisLab CodeIgniter 2.1.2 allows remote attackers to bypass the xss_clean() Filter and perform XSS attacks.

  45. 6.1CVE-2012-1261ExploitEPSS 2.2%

    Cross-site scripting (XSS) vulnerability in cgi-bin/scrut_fa_exclusions.cgi in Plixer International Scrutinizer NetFlow and sFlow Analyzer 8.6.2.16204 and other versions before 9.0.1.19899 allows remote attackers to inject arbitrary web sc…

  46. 6.1CVE-2012-1260ExploitEPSS 2.3%

    Cross-site scripting (XSS) vulnerability in cgi-bin/userprefs.cgi in Plixer International Scrutinizer NetFlow & sFlow Analyzer 8.6.2.16204, and possibly other versions before 9.0.1.19899, allows remote attackers to inject arbitrary web scr…

  47. 9.8CVE-2012-1259ExploitEPSS 4.2%

    Multiple SQL injection vulnerabilities in Plixer International Scrutinizer NetFlow & sFlow Analyzer 8.6.2.16204, and possibly other versions before 9.0.1.19899, allow remote attackers to execute arbitrary SQL commands via the (1) addip par…

  48. 6.5CVE-2012-1258ExploitEPSS 3.3%

    cgi-bin/userprefs.cgi in Plixer International Scrutinizer NetFlow & sFlow Analyzer before 9.0.1.19899 does not validate user permissions, which allow remote attackers to add user accounts with administrator privileges via the newuser, pwd,…

  49. 8.8CVE-2019-20224ExploitEPSS 50%

    netflow_get_stats in functions_netflow.php in Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ip_src parameter in an index.php?operation/netflow/nf_live_view request. Thi…

  50. 8.8CVE-2019-19494ExploitEPSS 23%

    Broadcom based cable modems across multiple vendors are vulnerable to a buffer overflow, which allows a remote attacker to execute arbitrary code at the kernel level via JavaScript run in a victim's browser. Examples of affected products i…