cve.bz

Matching records, newest first, page 97

Filter
  1. 7.7CVE-2021-21287ExploitEPSS 21%

    MinIO is a High Performance Object Storage released under Apache License v2.0. In MinIO before version RELEASE.2021-01-30T00-20-58Z there is a server-side request forgery vulnerability. The target application may have functionality for imp…

  2. 9.3CVE-2021-21276ExploitEPSS 7.2%

    Polr is an open source URL shortener. in Polr before version 2.3.0, a vulnerability in the setup process allows attackers to gain admin access to site instances, even if they do not possess an existing account. This vulnerability exists re…

  3. 9.8CVE-2020-15568ExploitEPSS 29%

    TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in include/exportUser.php, in which an attacker can trigger a call to the exec metho…

  4. 8.8CVE-2021-25646ExploitEPSS 99.0%

    Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and e…

  5. 5.4CVE-2021-3298ExploitEPSS 2.2%

    Collabtive 3.1 allows XSS when an authenticated user enters an XSS payload into the address section of the profile edit page, aka the manageuser.php?action=edit address1 parameter.

  6. 7.5CVE-2021-3337ExploitEPSS 12%

    The Hide-Thread-Content plugin through 2021-01-27 for MyBB allows remote attackers to bypass intended content-reading restrictions by clicking on reply or quote in the postbit.

  7. 7.2CVE-2020-35754ExploitEPSS 11%

    OpenSolution Quick.CMS < 6.7 and Quick.Cart < 6.7 allow an authenticated user to perform code injection (and consequently Remote Code Execution) via the input fields of the Language tab.

  8. 6.1CVE-2021-3318ExploitEPSS 2.9%

    attach/ajax.php in DzzOffice through 2.02.1 allows XSS via the editorid parameter.

  9. 8.8CVE-2021-3317ExploitEPSS 41%

    KLog Server through 2.4.1 allows authenticated command injection. async.php calls shell_exec() on the original value of the source parameter.

  10. 7.8CVE-2021-3156KEVExploitEPSS >99.9%

    Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.

  11. 7.8CVE-2021-3297ExploitEPSS 21%

    On Zyxel NBG2105 V1.00(AAGU.2)C0 devices, setting the login cookie to 1 provides administrator access.

  12. 7.2CVE-2021-3291ExploitEPSS 17%

    Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page) and inserting a command.

  13. 9.8CVE-2021-3278ExploitEPSS 25%

    Local Service Search Engine Management System 1.0 has a vulnerability through authentication bypass using SQL injection . Using this vulnerability, an attacker can bypass the login page.

  14. 7.5CVE-2021-3223ExploitEPSS 19%

    Node-RED-Dashboard before 2.26.2 allows ui_base/js/..%2f directory traversal to read files.

  15. 5.4CVE-2021-3186ExploitEPSS 2.5%

    A Stored Cross-site scripting (XSS) vulnerability in /main.html Wifi Settings in Tenda AC5 AC1200 version V15.03.06.47_multi allows remote attackers to inject arbitrary web script or HTML via the Wifi Name parameter.

  16. 5.3CVE-2021-3152ExploitEPSS 2.2%

    Home Assistant before 2021.1.3 does not have a protection layer that can help to prevent directory-traversal attacks against custom integrations. NOTE: the vendor's perspective is that the vulnerability itself is in custom integrations wri…

  17. 7.5CVE-2021-25864ExploitEPSS 9.3%

    node-red-contrib-huemagic 3.0.0 is affected by hue/assets/..%2F Directory Traversal.in the res.sendFile API, used in file hue-magic.js, to fetch an arbitrary file.

  18. 6.1CVE-2021-22873ExploitEPSS 70%

    Revive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the lg.php and ck.php delivery scripts. Such open redirects had previously been available by design to allow third party ad s…

  19. 8.8CVE-2020-35576ExploitEPSS 42%

    A Command Injection issue in the traceroute feature on TP-Link TL-WR841N V13 (JP) with firmware versions prior to 201216 allows authenticated users to execute arbitrary code as root via shell metacharacters, a different vulnerability than …

  20. 6.1CVE-2020-27735ExploitEPSS 5.8%

    An XSS issue was discovered in Wing FTP 6.4.4. An arbitrary IFRAME element can be included in the help pages via a crafted link, leading to the execution of (sandboxed) arbitrary HTML and JavaScript in the user's browser.

  21. 7.2CVE-2021-2109ExploitEPSS 71%

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability …

  22. 9.8CVE-2021-3110ExploitEPSS 19%

    The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the module=productcomments controller=CommentGrade id_products[] parameter.

  23. 6.5CVE-2020-19363ExploitEPSS 3.4%

    Vtiger CRM v7.2.0 allows an attacker to display hidden files, list directories by using /libraries and /layout directories.

  24. 7.5CVE-2020-19360ExploitEPSS 17%

    Local file inclusion in FHEM 6.0 allows in fhem/FileLog_logWrapper file parameter can allow an attacker to include a file, which can lead to sensitive information disclosure.

  25. 8.8CVE-2020-23342ExploitEPSS 12%

    A CSRF vulnerability exists in Anchor CMS 0.12.7 anchor/views/users/edit.php that can change the Delete admin users.

  26. 6.8CVE-2020-23522ExploitEPSS 2.0%

    Pixelimity 1.0 has cross-site request forgery via the admin/setting.php data [Password] parameter.

  27. 7.5CVE-2021-21246ExploitEPSS 49%

    OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the REST UserResource endpoint performs a security check to make sure that only administrators can list user details. However for the `/users/{id}` endpoint there are…

  28. 7.7CVE-2020-35749ExploitEPSS 30%

    Directory traversal vulnerability in class-simple_job_board_resume_download_handler.php in the Simple Board Job plugin 2.9.3 and earlier for WordPress allows remote attackers to read arbitrary files via the sjb_file parameter to wp-admin/p…

  29. 9.8CVE-2021-20617ExploitEPSS 7.4%

    Improper access control vulnerability in acmailer ver. 4.0.1 and earlier, and acmailer DB ver. 1.1.3 and earlier allows remote attackers to execute an arbitrary OS command, or gain an administrative privilege which may result in obtaining …

  30. 7.2CVE-2020-35578ExploitEPSS 82%

    An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0. Because the line-ending conversion feature is mishandled during a plugin upload, a remote, authenticated admin user can execute operating-system commands.

  31. 4.3CVE-2020-35687ExploitEPSS 1.4%

    PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim.

  32. 9.8CVE-2021-3129KEVExploitEPSS >99.9%

    Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using de…

  33. 6.1CVE-2020-24701ExploitEPSS 6.8%

    OX App Suite through 7.10.4 allows XSS via the app loading mechanism (the PATH_INFO to the /appsuite URI).

  34. 5.3CVE-2020-5147ExploitEPSS 1.7%

    SonicWall NetExtender Windows client vulnerable to unquoted service path vulnerability, this allows a local attacker to gain elevated privileges in the host operating system. This vulnerability impact SonicWall NetExtender Windows client v…

  35. 6.5CVE-2020-16040ExploitEPSS 99.5%

    Insufficient data validation in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

  36. 5.3CVE-2020-28208ExploitEPSS 11%

    An email address enumeration vulnerability exists in the password reset function of Rocket.Chat through 3.9.1.

  37. 9.8CVE-2020-35131ExploitEPSS 50%

    Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/MongoLite/Database.php, as demonstrated by values in JSON data to the /auth/check or /auth/requestre…

  38. 4.8CVE-2021-3111ExploitEPSS 3.0%

    The Express Entries Dashboard in Concrete5 8.5.4 allows stored XSS via the name field of a new data object at an index.php/dashboard/express/entries/view/ URI.

  39. 5.3CVE-2021-23241ExploitEPSS 13%

    MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ in conjunction with a loginLess or login.htm URI (for authentication bypass) to the web server, as demonstrated by the /loginLess/../../etc/passwd URI.

  40. 6.1CVE-2020-24903ExploitEPSS 2.9%

    Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting (XSS) caused by improper validation of user supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in…

  41. 6.1CVE-2020-24902ExploitEPSS 2.9%

    Quixplorer <=2.4.1 is vulnerable to reflected cross-site scripting (XSS) caused by improper validation of user supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in a victim…

  42. 7.7CVE-2021-21234ExploitEPSS 21%

    spring-boot-actuator-logview in a library that adds a simple logfile viewer as spring boot actuator endpoint. It is maven package "eu.hinsch:spring-boot-actuator-logview". In spring-boot-actuator-logview before version 0.2.13 there is a di…

  43. 7.5CVE-2020-35488ExploitEPSS 7.6%

    The fileop module of the NXLog service in NXLog Community Edition 2.10.2150 allows remote attackers to cause a denial of service (daemon crash) via a crafted Syslog payload to the Syslog service. This attack requires a specific configurati…

  44. 7.5CVE-2020-17519KEVExploitEPSS 98%

    A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted t…

  45. 7.5CVE-2020-17518ExploitEPSS 49%

    Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system, through a maliciously modified HTTP HEADER. The files can be written to any location accessible by Fl…

  46. 7.5CVE-2021-3019ExploitEPSS 17%

    ffay lanproxy 0.1 allows Directory Traversal to read /../conf/config.properties to obtain credentials for a connection to the intranet.

  47. 9.8CVE-2021-3018ExploitEPSS 19%

    ipeak Infosystems ibexwebCMS (aka IPeakCMS) 3.5 is vulnerable to an unauthenticated Boolean-based SQL injection via the id parameter on the /cms/print.php page.

  48. 9.8CVE-2020-36155ExploitEPSS 9.8%

    An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta. An attacker could supply an array parameter for sensitive metadata, such as the wp_capabilities user…

  49. 9.8CVE-2020-36112ExploitEPSS 18%

    CSE Bookstore version 1.0 is vulnerable to time-based blind, boolean-based blind and OR error-based SQL injection in pubid parameter in bookPerPub.php and in cart.php. A successful exploitation of this vulnerability will lead to an attacke…

  50. 9.8CVE-2021-3007ExploitEPSS 75%

    Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Str…