CVE-2022-20775 | HIGH | 7.8 | 0.12475 | 60.57 | Yes | No | 2022-09-30 | 2026-03-02 | cisa.gov, euvd | A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges.
This vulner…A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges.
This vulnerability is due to improper access controls on commands within the application CLI. An attacker could exploit this vulnerability by running a maliciously crafted command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF |
CVE-2024-23478 | HIGH | 8.0 | 0.81588 | 60.56 | No | No | 2024-02-15 | 2024-08-12 | euvd | SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Remote Code Execution Vulnerability. If exploited, this vulnerabilit…SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Remote Code Execution Vulnerability. If exploited, this vulnerability allows an authenticated user to abuse a SolarWinds service, resulting in remote code execution. |
CVE-2020-3569 | HIGH | 8.6 | 0.03293 | 60.55 | Yes | No | 2020-09-23 | 2025-10-21 | cisa.gov, euvd | Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthent…Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to either immediately crash the Internet Group Management Protocol (IGMP) process or make it consume available memory and eventually crash. The memory consumption may negatively impact other processes that are running on the device. These vulnerabilities are due to the incorrect handling of IGMP packets. An attacker could exploit these vulnerabilities by sending crafted IGMP traffic to an affected device. A successful exploit could allow the attacker to immediately crash the IGMP process or cause memory exhaustion, resulting in other processes becoming unstable. These processes may include, but are not limited to, interior and exterior routing protocols. Cisco will release software updates that address these vulnerabilities. |
CVE-2025-3928 | HIGH | 8.7 | 0.02089 | 60.53 | Yes | No | 2025-04-25 | 2026-02-26 | cisa.gov, euvd | Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault …Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28. |
CVE-2023-3486 | HIGH | 8.2 | 0.79159 | 60.51 | No | No | 2023-07-25 | 2024-10-23 | euvd | An authentication bypass exists in PaperCut NG versions 22.0.12 and prior that could allow a remote, unauthenticated attacker to upload arbi…An authentication bypass exists in PaperCut NG versions 22.0.12 and prior that could allow a remote, unauthenticated attacker to upload arbitrary files to the PaperCut NG host’s file storage. This could exhaust system resources and prevent the service from operating as expected. |
CVE-2022-36098 | HIGH | 8.9 | 0.71043 | 60.47 | No | No | 2022-09-08 | 2025-04-22 | euvd | XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in…XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in version 12.5-rc-1 and prior to versions 13.10.6 and 14.4, it's possible to store Javascript or groovy scripts in a mention, macro anchor, or reference field. The stored code is executed by anyone visiting the page with the mention. This issue has been patched on XWiki 14.4 and 13.10.6. As a workaround, one may update `XWiki.Mentions.MentionsMacro` and edit the `Macro code` field of the `XWiki.WikiMacroClass` XObject. |
CVE-2010-3904 | HIGH | 7.8 | 0.12159 | 60.46 | Yes | No | 2010-12-06 | 2025-10-22 | cisa.gov, euvd | The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before …The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls. |
CVE-2023-36424 | HIGH | 7.8 | 0.12184 | 60.46 | Yes | No | 2023-11-14 | 2026-04-14 | cisa.gov, euvd | Windows Common Log File System Driver Elevation of Privilege VulnerabilityWindows Common Log File System Driver Elevation of Privilege Vulnerability |
CVE-2025-6554 | HIGH | 8.1 | 0.0863 | 60.42 | Yes | No | 2025-06-30 | 2025-10-21 | cisa.gov, euvd | Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML pa…Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High) |
CVE-2023-36745 | HIGH | 8.0 | 0.81138 | 60.4 | No | No | 2023-09-12 | 2025-10-30 | euvd | Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server Remote Code Execution Vulnerability |
CVE-2026-22200 | HIGH | 8.7 | 0.73125 | 60.39 | No | Yes | 2026-01-12 | 2026-07-14 | euvd, packetstorm | Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket P…Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML that includes PHP filter expressions which are insufficiently sanitized before being processed by the mPDF PDF generator during export. When the attacker exports the ticket to PDF, the generated PDF can embed the contents of attacker-selected files from the server filesystem as bitmap images, allowing disclosure of sensitive local files in the context of the osTicket application user. This issue is exploitable in default configurations where guests may create tickets and access ticket status, or where self-registration is enabled. |
CVE-2025-48543 | HIGH | 8.8 | 0.00531 | 60.39 | Yes | No | 2025-09-04 | 2026-02-26 | cisa.gov, euvd | In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free. This could …In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
CVE-2023-36033 | HIGH | 7.8 | 0.11977 | 60.39 | Yes | No | 2023-11-14 | 2025-10-21 | cisa.gov, euvd | Windows DWM Core Library Elevation of Privilege VulnerabilityWindows DWM Core Library Elevation of Privilege Vulnerability |
CVE-2023-46264 | HIGH | 7.2 | 0.9019 | 60.37 | No | No | 2023-12-19 | 2024-09-04 | euvd | An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker t…An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove code execution. |
CVE-2024-27919 | HIGH | 7.5 | 0.86746 | 60.36 | No | No | 2024-04-04 | 2025-11-04 | euvd | Envoy is a cloud-native, open-source edge and service proxy. In versions 1.29.0 and 1.29.1, theEnvoy HTTP/2 protocol stack is vulnerable to …Envoy is a cloud-native, open-source edge and service proxy. In versions 1.29.0 and 1.29.1, theEnvoy HTTP/2 protocol stack is vulnerable to the flood of CONTINUATION frames. Envoy's HTTP/2 codec does not reset a request when header map limits have been exceeded. This allows an attacker to send an sequence of CONTINUATION frames without the END_HEADERS bit set causing unlimited memory consumption. This can lead to denial of service through memory exhaustion. Users should upgrade to versions 1.29.2 to mitigate the effects of the CONTINUATION flood. Note that this vulnerability is a regression in Envoy version 1.29.0 and 1.29.1 only. As a workaround, downgrade to version 1.28.1 or earlier or disable HTTP/2 protocol for downstream connections. |
CVE-2025-40553 | CRITICAL | 9.8 | 0.6039 | 60.34 | No | No | 2026-01-28 | 2026-02-27 | euvd | SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execu…SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication. |
CVE-2022-21972 | HIGH | 8.1 | 0.79827 | 60.34 | No | No | 2022-05-10 | 2025-01-02 | euvd | Windows Point-to-Point Tunneling Protocol Remote Code Execution VulnerabilityWindows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability |
CVE-2025-25256 | CRITICAL | 9.8 | 0.60344 | 60.32 | No | No | 2025-08-12 | 2026-02-26 | euvd | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSIEM v…An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSIEM version 7.3.0 through 7.3.1, 7.2.0 through 7.2.5, 7.1.0 through 7.1.7, 7.0.0 through 7.0.3 and before 6.7.9 allows an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests. |
CVE-2023-29919 | CRITICAL | 9.8 | 0.60221 | 60.28 | No | No | 2023-05-23 | 2025-01-17 | euvd | SolarView Compact <= 6.0 is vulnerable to Insecure Permissions. Any file on the server can be read or modified because texteditor.php is not…SolarView Compact <= 6.0 is vulnerable to Insecure Permissions. Any file on the server can be read or modified because texteditor.php is not restricted. |
CVE-2019-1253 | HIGH | 7.8 | 0.11616 | 60.27 | Yes | No | 2019-09-11 | 2025-10-21 | cisa.gov, euvd | An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerab…An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1215, CVE-2019-1278, CVE-2019-1303. |
CVE-2024-49035 | HIGH | 8.7 | 0.01339 | 60.27 | Yes | No | 2024-11-26 | 2025-10-21 | cisa.gov, euvd | An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network.An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network. |
CVE-2020-3250 | CRITICAL | 9.8 | 0.60158 | 60.26 | No | No | 2020-04-15 | 2024-11-15 | euvd | Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to by…Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication or conduct directory traversal attacks on an affected device. For more information about these vulnerabilities, see the Details section of this advisory. |
CVE-2022-0028 | HIGH | 8.6 | 0.02366 | 60.23 | Yes | No | 2022-08-10 | 2025-10-21 | cisa.gov, euvd | A PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service…A PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks. The DoS attack would appear to originate from a Palo Alto Networks PA-Series (hardware), VM-Series (virtual) and CN-Series (container) firewall against an attacker-specified target. To be misused by an external attacker, the firewall configuration must have a URL filtering profile with one or more blocked categories assigned to a source zone that has an external facing interface. This configuration is not typical for URL filtering and, if set, is likely unintended by the administrator. If exploited, this issue would not impact the confidentiality, integrity, or availability of our products. However, the resulting denial-of-service (DoS) attack may help obfuscate the identity of the attacker and implicate the firewall as the source of the attack. We have taken prompt action to address this issue in our PAN-OS software. All software updates for this issue are expected to be released no later than the week of August 15, 2022. This issue does not impact Panorama M-Series or Panorama virtual appliances. This issue has been resolved for all Cloud NGFW and Prisma Access customers and no additional action is required from them. |
CVE-2022-24682 | MEDIUM | 6.1 | 0.30931 | 60.23 | Yes | No | 2022-02-09 | 2026-08-07 | cisa.gov, euvd, nvd | An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the w…An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document. |
CVE-2024-4990 | HIGH | 8.1 | 0.79528 | 60.23 | No | No | 2025-03-20 | 2025-03-20 | euvd | In yiisoft/yii2 version 2.0.48, the base Component class contains a vulnerability where the `__set()` magic method does not validate that th…In yiisoft/yii2 version 2.0.48, the base Component class contains a vulnerability where the `__set()` magic method does not validate that the value passed is a valid Behavior class name or configuration. This allows an attacker to instantiate arbitrary classes, passing parameters to their constructors and invoking setter methods. Depending on the installed dependencies, various types of attacks are possible, including the execution of arbitrary code, retrieval of sensitive information, and unauthorized access. |
CVE-2025-30154 | HIGH | 8.6 | 0.02296 | 60.2 | Yes | No | 2025-03-19 | 2026-02-26 | cisa.gov, euvd | reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 a…reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos. |
CVE-2021-38648 | HIGH | 7.8 | 0.11424 | 60.2 | Yes | No | 2021-09-15 | 2025-10-21 | cisa.gov, euvd | Open Management Infrastructure Elevation of Privilege VulnerabilityOpen Management Infrastructure Elevation of Privilege Vulnerability |
CVE-2016-3351 | MEDIUM | 6.5 | 0.26286 | 60.2 | Yes | No | 2016-09-14 | 2025-10-21 | cisa.gov, euvd | Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, a…Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability." |
CVE-2026-45659 | HIGH | 8.0 | 0.0912 | 60.19 | Yes | Yes | 2026-07-07 | 2026-07-06 | cisa.gov, cnvd, euvd, nvd, packetstorm | Microsoft Office SharePoint is an enterprise content collaboration and document management platform of Microsoft Corporation in the United S…Microsoft Office SharePoint is an enterprise content collaboration and document management platform of Microsoft Corporation in the United States. There is a security vulnerability in Microsoft Office SharePoint. An attacker could exploit this vulnerability to execute code over the network. |
CVE-2022-34753 | HIGH | 8.8 | 0.71284 | 60.15 | No | No | 2022-07-13 | 2024-09-16 | euvd | A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause r…A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote root exploit when the command is compromised. Affected Products: SpaceLogic C-Bus Home Controller (5200WHC2), formerly known as C-Bus Wiser Homer Controller MK2 (V1.31.460 and prior) |
CVE-2023-38180 | HIGH | 7.5 | 0.14688 | 60.14 | Yes | No | 2023-08-08 | 2025-10-21 | cisa.gov, euvd | .NET and Visual Studio Denial of Service Vulnerability.NET and Visual Studio Denial of Service Vulnerability |
CVE-2024-2961 | HIGH | 7.3 | 0.8833 | 60.12 | No | Yes | 2024-04-17 | 2026-07-14 | euvd, github | The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converti…The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable. |
CVE-2025-24799 | HIGH | 7.5 | 0.86067 | 60.12 | No | No | 2025-03-18 | 2025-03-18 | euvd | GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint.…GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 10.0.18. |
CVE-2017-0005 | HIGH | 7.8 | 0.11022 | 60.06 | Yes | No | 2017-03-17 | 2025-10-21 | cisa.gov, euvd | The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows …The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application, aka "Windows GDI Elevation of Privilege Vulnerability." This vulnerability is different from those described in CVE-2017-0001, CVE-2017-0025, and CVE-2017-0047. |
CVE-2024-24992 | HIGH | 8.8 | 0.70908 | 60.02 | No | No | 2024-04-19 | 2025-01-07 | euvd | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary…A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM. |
CVE-2021-35215 | HIGH | 8.9 | 0.69731 | 60.01 | No | No | 2021-09-01 | 2024-09-16 | euvd | Insecure deserialization leading to Remote Code Execution was detected in the Orion Platform version 2020.2.5. Authentication is required to…Insecure deserialization leading to Remote Code Execution was detected in the Orion Platform version 2020.2.5. Authentication is required to exploit this vulnerability. |
CVE-2023-23376 | HIGH | 7.8 | 0.10853 | 60.0 | Yes | No | 2023-02-14 | 2026-08-05 | cisa.gov, euvd, nvd | Windows Common Log File System Driver Elevation of Privilege VulnerabilityWindows Common Log File System Driver Elevation of Privilege Vulnerability |
CVE-2022-2560 | HIGH | 8.2 | 0.77688 | 59.99 | No | No | 2023-03-29 | 2025-02-18 | euvd | This vulnerability allows remote attackers to delete arbitrary files on affected installations of EnterpriseDT CompleteFTP 22.1.0 Server. Au…This vulnerability allows remote attackers to delete arbitrary files on affected installations of EnterpriseDT CompleteFTP 22.1.0 Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HttpFile class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of SYSTEM. Was ZDI-CAN-17481. |
CVE-2017-1000253 | HIGH | 7.8 | 0.10695 | 59.94 | Yes | No | 2017-10-04 | 2025-10-21 | cisa.gov, euvd | Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86…Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. With CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down address allocation strategy, load_elf_binary() will attempt to map a PIE binary into an address range immediately below mm->mmap_base. Unfortunately, load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary which means that, while the first PT_LOAD segment is mapped below mm->mmap_base, the subsequent PT_LOAD segment(s) end up being mapped above mm->mmap_base into the are that is supposed to be the "gap" between the stack and the binary. |
CVE-2014-0783 | CRITICAL | 9.0 | 0.68359 | 59.93 | No | No | 2014-03-14 | 2025-09-25 | euvd | Stack-based buffer overflow in BKHOdeq.exe in Yokogawa CENTUM CS 3000 R3.09.50 and earlier allows remote attackers to execute arbitrary code…Stack-based buffer overflow in BKHOdeq.exe in Yokogawa CENTUM CS 3000 R3.09.50 and earlier allows remote attackers to execute arbitrary code via a crafted TCP packet. |
CVE-2020-17143 | HIGH | 8.8 | 0.70632 | 59.92 | No | No | 2020-12-09 | 2026-06-09 | euvd | Microsoft Exchange Server Information Disclosure VulnerabilityMicrosoft Exchange Server Information Disclosure Vulnerability |
CVE-2024-54003 | HIGH | 8.0 | 0.79731 | 59.91 | No | No | 2024-11-27 | 2024-11-27 | euvd | Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site scripting (XSS) vulnerability …Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Create permission. |
CVE-2026-42945 | CRITICAL | 9.2 | 0.66039 | 59.91 | No | Yes | 2026-05-13 | 2026-07-20 | euvd, packetstorm | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite dire…NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
CVE-2022-2143 | CRITICAL | 9.8 | 0.59184 | 59.91 | No | No | 2022-07-22 | 2025-04-16 | euvd | The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code.The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code. |
CVE-2022-2487 | HIGH | 8.0 | 0.79513 | 59.83 | No | No | 2022-07-20 | 2025-04-15 | euvd | A vulnerability has been found in WAVLINK WN535K2 and WN535K3 and classified as critical. This vulnerability affects unknown code of the fil…A vulnerability has been found in WAVLINK WN535K2 and WN535K3 and classified as critical. This vulnerability affects unknown code of the file /cgi-bin/nightled.cgi. The manipulation of the argument start_hour leads to os command injection. The exploit has been disclosed to the public and may be used. |
CVE-2020-27932 | HIGH | 7.8 | 0.10337 | 59.82 | Yes | No | 2020-12-08 | 2025-10-21 | cisa.gov, euvd | A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, wat…A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Mojave, iOS 14.2 and iPadOS 14.2, watchOS 5.3.9, macOS Catalina 10.15.7 Supplemental Update, macOS Catalina 10.15.7 Update. A malicious application may be able to execute arbitrary code with kernel privileges. |
CVE-2023-27034 | CRITICAL | 9.8 | 0.58743 | 59.76 | No | No | 2023-03-23 | 2025-02-25 | euvd | PrestaShop jmsblog 2.5.5 was discovered to contain a SQL injection vulnerability.PrestaShop jmsblog 2.5.5 was discovered to contain a SQL injection vulnerability. |
CVE-2020-3433 | HIGH | 7.8 | 0.10049 | 59.72 | Yes | No | 2020-08-17 | 2025-10-21 | cisa.gov, euvd | A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authen…A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. |
CVE-2023-32046 | HIGH | 7.8 | 0.10049 | 59.72 | Yes | No | 2023-07-11 | 2026-01-12 | cisa.gov, euvd | Windows MSHTML Platform Elevation of Privilege VulnerabilityWindows MSHTML Platform Elevation of Privilege Vulnerability |
CVE-2017-0263 | HIGH | 7.8 | 0.10034 | 59.71 | Yes | No | 2017-05-12 | 2025-10-21 | cisa.gov, euvd | The kernel-mode drivers in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Window…The kernel-mode drivers in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability." |