CVE-2021-22600 | MEDIUM | 6.6 | 0.0587 | 53.45 | Yes | No | 2022-01-26 | 2025-10-21 | cisa.gov, euvd | A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privi…A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755 |
CVE-2020-24913 | CRITICAL | 9.8 | 0.40621 | 53.42 | No | No | 2021-03-04 | 2026-07-09 | euvd, nvd | A SQL injection vulnerability in qcubed (all versions including 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated a…A SQL injection vulnerability in qcubed (all versions including 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request. |
CVE-2023-1730 | CRITICAL | 9.8 | 0.40586 | 53.41 | No | No | 2023-05-02 | 2025-01-30 | euvd | The SupportCandy WordPress plugin before 3.1.5 does not validate and escape user input before using it in an SQL statement, which could allo…The SupportCandy WordPress plugin before 3.1.5 does not validate and escape user input before using it in an SQL statement, which could allow unauthenticated attackers to perform SQL injection attacks |
CVE-2021-27083 | HIGH | 7.8 | 0.63446 | 53.41 | No | No | 2021-03-11 | 2024-08-03 | euvd | Remote Development Extension for Visual Studio Code Remote Code Execution VulnerabilityRemote Development Extension for Visual Studio Code Remote Code Execution Vulnerability |
CVE-2024-50330 | CRITICAL | 9.8 | 0.40512 | 53.38 | No | No | 2024-11-12 | 2024-11-19 | euvd | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauthent…SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauthenticated attacker to achieve remote code execution. |
CVE-2020-7774 | HIGH | 7.3 | 0.69062 | 53.37 | No | No | 2020-11-17 | 2024-09-16 | euvd | The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution. |
CVE-2017-14463 | CRITICAL | 10.0 | 0.38208 | 53.37 | No | No | 2018-04-05 | 2024-09-17 | euvd | An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Microl…An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before. A specially crafted packet can cause a read or write operation resulting in disclosure of sensitive information, modification of settings, or modification of ladder logic. An attacker can send unauthenticated packets to trigger this vulnerability. Required Keyswitch State: REMOTE or PROG Associated Fault Code: 0012 Fault Type: Non-User Description: A fault state can be triggered by overwriting the ladder logic data file (type 0x22 number 0x02) with null values. |
CVE-2013-0810 | HIGH | 8.1 | 0.59885 | 53.36 | No | No | 2013-09-11 | 2024-10-21 | euvd | Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, and Windows Server 2008 SP2 allow remote attackers to execute …Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, and Windows Server 2008 SP2 allow remote attackers to execute arbitrary code via a crafted screensaver in a theme file, aka "Windows Theme File Remote Code Execution Vulnerability." |
CVE-2025-49596 | CRITICAL | 9.4 | 0.44998 | 53.35 | No | No | 2025-06-13 | 2025-07-09 | euvd | The MCP inspector is a developer tool for testing and debugging MCP servers. Versions of MCP Inspector below 0.14.1 are vulnerable to remote…The MCP inspector is a developer tool for testing and debugging MCP servers. Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio. Users should immediately upgrade to version 0.14.1 or later to address these vulnerabilities. |
CVE-2013-1675 | MEDIUM | 6.5 | 0.06696 | 53.34 | Yes | No | 2013-05-16 | 2025-10-22 | cisa.gov, euvd | Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not proper…Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site. |
CVE-2023-3959 | CRITICAL | 9.8 | 0.40396 | 53.34 | No | No | 2023-11-08 | 2025-01-16 | euvd | Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220,
CB6231, B8520, B8220, and CD321
IP Cameras
with firmware version M2.1.6.05…Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220,
CB6231, B8520, B8220, and CD321
IP Cameras
with firmware version M2.1.6.05 are
vulnerable to multiple instances of stack-based overflows. While
processing XML elements from incoming network requests, the product does
not sufficiently check or validate allocated buffer size. This may lead
to remote code execution. |
CVE-2020-5377 | CRITICAL | 9.1 | 0.48332 | 53.32 | No | No | 2020-07-28 | 2024-09-17 | euvd | Dell EMC OpenManage Server Administrator (OMSA) versions 9.4 and prior contain multiple path traversal vulnerabilities. An unauthenticated r…Dell EMC OpenManage Server Administrator (OMSA) versions 9.4 and prior contain multiple path traversal vulnerabilities. An unauthenticated remote attacker could potentially exploit these vulnerabilities by sending a crafted Web API request containing directory traversal character sequences to gain file system access on the compromised management station. |
CVE-2024-6119 | HIGH | 7.5 | 0.66582 | 53.3 | No | No | 2024-09-03 | 2026-07-14 | euvd | Issue summary: Applications performing certificate name checks (e.g., TLS
clients checking server certificates) may attempt to read an inval…Issue summary: Applications performing certificate name checks (e.g., TLS
clients checking server certificates) may attempt to read an invalid memory
address resulting in abnormal termination of the application process.
Impact summary: Abnormal termination of an application can a cause a denial of
service.
Applications performing certificate name checks (e.g., TLS clients checking
server certificates) may attempt to read an invalid memory address when
comparing the expected name with an `otherName` subject alternative name of an
X.509 certificate. This may result in an exception that terminates the
application program.
Note that basic certificate chain validation (signatures, dates, ...) is not
affected, the denial of service can occur only when the application also
specifies an expected DNS name, Email address or IP address.
TLS servers rarely solicit client certificates, and even when they do, they
generally don't perform a name check against a reference identifier (expected
identity), but rather extract the presented identity after checking the
certificate chain. So TLS servers are generally not affected and the severity
of the issue is Moderate.
The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue. |
CVE-2025-55752 | HIGH | 7.5 | 0.66535 | 53.29 | No | No | 2025-10-27 | 2026-05-12 | euvd | Relative Path Traversal vulnerability in Apache Tomcat.
The fix for bug 60013 introduced a regression where the rewritten URL was nor…Relative Path Traversal vulnerability in Apache Tomcat.
The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108.
The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue. |
CVE-2019-11479 | MEDIUM | 5.3 | 0.9166 | 53.28 | No | No | 2019-06-18 | 2024-09-16 | euvd | Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend que…Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commits 967c05aee439e6e5d7d805e195b3a20ef5c433d6 and 5f3e2bf008c2221478101ee72f5cb4654b9fc363. |
CVE-2024-9916 | MEDIUM | 6.9 | 0.73338 | 53.27 | No | No | 2024-10-13 | 2024-10-15 | euvd | A vulnerability, which was classified as critical, has been found in HuangDou UTCMS V9. Affected by this issue is some unknown functionality…A vulnerability, which was classified as critical, has been found in HuangDou UTCMS V9. Affected by this issue is some unknown functionality of the file app/modules/ut-cac/admin/cli.php. The manipulation of the argument o leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. |
CVE-2021-28472 | HIGH | 7.8 | 0.63034 | 53.26 | No | No | 2021-04-13 | 2024-11-19 | euvd | Visual Studio Code Maven for Java Extension Remote Code Execution VulnerabilityVisual Studio Code Maven for Java Extension Remote Code Execution Vulnerability |
CVE-2024-39943 | CRITICAL | 9.9 | 0.39011 | 53.25 | No | No | 2024-07-04 | 2024-08-02 | euvd | rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if …rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSync in child_process in Node.js). |
CVE-2025-52694 | CRITICAL | 10.0 | 0.37867 | 53.25 | No | No | 2026-01-12 | 2026-01-26 | euvd | Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands …Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable service when it is exposed to the Internet, potentially affecting data confidentiality, integrity, and availability. Users and administrators of affected product versions are advised to update to the latest versions immediately. |
CVE-2024-38018 | HIGH | 8.8 | 0.51461 | 53.21 | No | No | 2024-09-10 | 2024-12-31 | euvd | Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2022-31097 | HIGH | 7.3 | 0.68603 | 53.21 | No | No | 2022-07-15 | 2026-01-28 | euvd | Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8…Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting. |
CVE-2023-35138 | CRITICAL | 9.8 | 0.39998 | 53.2 | No | No | 2023-11-30 | 2024-08-02 | euvd | A command injection vulnerability in the “show_zysync_server_contents” function of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NA…A command injection vulnerability in the “show_zysync_server_contents” function of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request. |
CVE-2020-4241 | HIGH | 7.5 | 0.66298 | 53.2 | No | No | 2020-03-31 | 2024-09-16 | euvd | IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary comm…IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 175418. |
CVE-2018-16873 | HIGH | 7.5 | 0.66252 | 53.19 | No | No | 2018-12-14 | 2024-08-05 | euvd | In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and…In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). Using custom domains, it's possible to arrange things so that a Git repository is cloned to a folder named ".git" by using a vanity import path that ends with "/.git". If the Git repository root contains a "HEAD" file, a "config" file, an "objects" directory, a "refs" directory, with some work to ensure the proper ordering of operations, "go get -u" can be tricked into considering the parent directory as a repository root, and running Git commands on it. That will use the "config" file in the original Git repository root for its configuration, and if that config file contains malicious commands, they will execute on the system running "go get -u". |
CVE-2026-20079 | CRITICAL | 10.0 | 0.37671 | 53.18 | No | No | 2026-03-04 | 2026-08-05 | euvd, nvd | A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attack…A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.
This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device. |
CVE-2022-48618 | HIGH | 7.0 | 0.00487 | 53.17 | Yes | No | 2024-01-09 | 2025-10-21 | cisa.gov, euvd | The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2, tvOS 16.2. A…The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2, tvOS 16.2. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited against versions of iOS released before iOS 15.7.1. |
CVE-2024-24725 | HIGH | 8.8 | 0.5132 | 53.16 | No | No | 2024-03-23 | 2024-08-27 | euvd | Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the mod…Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php&type=externalAssessment&step=4 URI. |
CVE-2013-2566 | MEDIUM | 5.9 | 0.84424 | 53.15 | No | No | 2013-03-14 | 2026-05-22 | euvd | The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to …The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct plaintext-recovery attacks via statistical analysis of ciphertext in a large number of sessions that use the same plaintext. |
CVE-2021-28476 | CRITICAL | 9.9 | 0.38625 | 53.12 | No | No | 2021-05-11 | 2024-08-03 | euvd | Windows Hyper-V Remote Code Execution VulnerabilityWindows Hyper-V Remote Code Execution Vulnerability |
CVE-2025-12420 | CRITICAL | 9.3 | 0.4549 | 53.12 | No | No | 2026-01-12 | 2026-02-26 | euvd | A vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and …A vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform the operations that the impersonated user is entitled to perform.
ServiceNow has addressed this vulnerability by deploying a relevant security update to hosted instances in October 2025. Security updates have also been provided to ServiceNow self-hosted customers, partners, and hosted customers with unique configurations. Additionally, the vulnerability is addressed in the listed Store App versions. We recommend that customers promptly apply an appropriate security update or upgrade if they have not already done so. |
CVE-2020-11899 | MEDIUM | 5.4 | 0.18564 | 53.1 | Yes | No | 2020-06-17 | 2025-10-21 | cisa.gov, euvd | The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read. |
CVE-2024-53944 | CRITICAL | 9.8 | 0.39682 | 53.09 | No | No | 2025-02-27 | 2025-03-04 | euvd | An issue was discovered on Tuoshi/Dionlink LT15D 4G Wi-Fi devices through M7628NNxlSPv2xUI_v1.0.1802.10.08_P4 and LT21B devices through M762…An issue was discovered on Tuoshi/Dionlink LT15D 4G Wi-Fi devices through M7628NNxlSPv2xUI_v1.0.1802.10.08_P4 and LT21B devices through M7628xUSAxUIv2_v1.0.1481.15.02_P0. A unauthenticated remote attacker with network access can exploit a command injection vulnerability. The /goform/formJsonAjaxReq endpoint fails to sanitize shell metacharacters sent via JSON parameters, thus allowing attackers to execute arbitrary OS commands with root privileges. |
CVE-2014-0782 | HIGH | 8.3 | 0.56839 | 53.09 | No | No | 2014-05-16 | 2025-09-25 | euvd | Stack-based buffer overflow in BKESimmgr.exe in the Expanded Test Functions package in Yokogawa CENTUM CS 1000, CENTUM CS 3000 Entry Class R…Stack-based buffer overflow in BKESimmgr.exe in the Expanded Test Functions package in Yokogawa CENTUM CS 1000, CENTUM CS 3000 Entry Class R3.09.50 and earlier, CENTUM VP R5.03.00 and earlier, CENTUM VP Entry Class R5.03.00 and earlier, Exaopc R3.71.02 and earlier, B/M9000CS R5.05.01 and earlier, and B/M9000 VP R7.03.01 and earlier allows remote attackers to execute arbitrary code via a crafted packet. |
CVE-2024-46986 | CRITICAL | 10.0 | 0.37358 | 53.08 | No | Yes | 2024-09-18 | 2025-04-17 | euvd, github | Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. An arbitrary file write vulnerability accessible vi…Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. An arbitrary file write vulnerability accessible via the upload method of the MediaController allows authenticated users to write arbitrary files to any location on the web server Camaleon CMS is running on (depending on the permissions of the underlying filesystem). E.g. This can lead to a delayed remote code execution in case an attacker is able to write a Ruby file into the config/initializers/ subfolder of the Ruby on Rails application. This issue has been addressed in release version 2.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
CVE-2023-29374 | CRITICAL | 9.8 | 0.39653 | 53.08 | No | No | 2023-04-05 | 2025-02-12 | euvd | In LangChain through 0.0.131, the LLMMathChain chain allows prompt injection attacks that can execute arbitrary code via the Python exec met…In LangChain through 0.0.131, the LLMMathChain chain allows prompt injection attacks that can execute arbitrary code via the Python exec method. |
CVE-2024-25065 | CRITICAL | 9.1 | 0.47667 | 53.08 | No | No | 2024-02-28 | 2025-02-13 | euvd | Possible path traversal in Apache OFBiz allowing authentication bypass.
Users are recommended to upgrade to version 18.12.12, that fixes the…Possible path traversal in Apache OFBiz allowing authentication bypass.
Users are recommended to upgrade to version 18.12.12, that fixes the issue. |
CVE-2025-35939 | MEDIUM | 6.9 | 0.01317 | 53.06 | Yes | No | 2025-05-07 | 2026-02-26 | cisa.gov, euvd | Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly…Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at '/var/lib/php/sessions'. Such session files are named 'sess_[session_value]', where '[session_value]' is provided to the client in a 'Set-Cookie' response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this issue. |
CVE-2017-14469 | CRITICAL | 10.0 | 0.37317 | 53.06 | No | No | 2018-04-05 | 2024-09-16 | euvd | An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Microl…An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before. A specially crafted packet can cause a read or write operation resulting in disclosure of sensitive information, modification of settings, or modification of ladder logic. An attacker can send unauthenticated packets to trigger this vulnerability. Required Keyswitch State: REMOTE or PROG Associated Fault Code: 0028 Fault Type: Non-User Description: Values 0x01 and 0x02 are invalid values for the user fault routine. By writing directly to the file it is possible to set these values. When this is done and the device is moved into a run state, a fault is triggered. NOTE: This is not possible through RSLogix. |
CVE-2017-14471 | CRITICAL | 10.0 | 0.37317 | 53.06 | No | No | 2018-04-05 | 2024-09-16 | euvd | An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Microl…An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before. A specially crafted packet can cause a read or write operation resulting in disclosure of sensitive information, modification of settings, or modification of ladder logic. An attacker can send unauthenticated packets to trigger this vulnerability. Required Keyswitch State: REMOTE or PROG Associated Fault Codes: 0023, 002e, and 0037 Fault Type: Recoverable Description: The STI, EII, and HSC function files contain bits signifying whether or not a fault has occurred. Additionally there is a bit signaling the module to auto start. When these bits are set for any of the three modules and the device is moved into a run state, a fault is triggered. |
CVE-2017-14473 | CRITICAL | 10.0 | 0.37317 | 53.06 | No | No | 2018-04-05 | 2024-09-16 | euvd | An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Microl…An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before. A specially crafted packet can cause a read or write operation resulting in disclosure of sensitive information, modification of settings, or modification of ladder logic. An attacker can send unauthenticated packets to trigger this vulnerability. Required Keyswitch State: Any Description: Reads the encoded ladder logic from its data file and print it out in HEX. |
CVE-2017-14468 | CRITICAL | 10.0 | 0.37317 | 53.06 | No | No | 2018-04-05 | 2024-09-17 | euvd | An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Microl…An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before. A specially crafted packet can cause a read or write operation resulting in disclosure of sensitive information, modification of settings, or modification of ladder logic. An attacker can send unauthenticated packets to trigger this vulnerability. Required Keyswitch State: REMOTE or PROG Description: This ability is leveraged in a larger exploit to flash custom firmware. |
CVE-2017-14464 | CRITICAL | 10.0 | 0.37317 | 53.06 | No | No | 2018-04-05 | 2024-09-16 | euvd | An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Microl…An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before. A specially crafted packet can cause a read or write operation resulting in disclosure of sensitive information, modification of settings, or modification of ladder logic. An attacker can send unauthenticated packets to trigger this vulnerability.Required Keyswitch State: REMOTE or PROG Associated Fault Code: 0001 Fault Type: Non-User Description: A fault state can be triggered by setting the NVRAM/memory module user program mismatch bit (S2:9) when a memory module is NOT installed. |
CVE-2017-14472 | CRITICAL | 10.0 | 0.37317 | 53.06 | No | No | 2018-04-05 | 2024-09-16 | euvd | An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Microl…An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before. A specially crafted packet can cause a read or write operation resulting in disclosure of sensitive information, modification of settings, or modification of ladder logic. An attacker can send unauthenticated packets to trigger this vulnerability. Required Keyswitch State: Any Description: Requests a specific set of bytes from an undocumented data file and returns the ASCII version of the master password. |
CVE-2017-14470 | CRITICAL | 10.0 | 0.37317 | 53.06 | No | No | 2018-04-05 | 2024-09-17 | euvd | An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Microl…An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before. A specially crafted packet can cause a read or write operation resulting in disclosure of sensitive information, modification of settings, or modification of ladder logic. An attacker can send unauthenticated packets to trigger this vulnerability. Required Keyswitch State: REMOTE or PROG or RUN Description: The value 0xffffffff is considered NaN for the Float data type. When a float is set to this value and used in the PLC, a fault is triggered. NOTE: This is not possible through RSLogix. |
CVE-2017-14466 | CRITICAL | 10.0 | 0.37317 | 53.06 | No | No | 2018-04-05 | 2024-09-17 | euvd | An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Microl…An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before. A specially crafted packet can cause a read or write operation resulting in disclosure of sensitive information, modification of settings, or modification of ladder logic. An attacker can send unauthenticated packets to trigger this vulnerability. Required Keyswitch State: REMOTE or PROG Description: The filetype 0x03 allows users write access, allowing the ability to overwrite the Master Password value stored in the file. |
CVE-2022-45402 | MEDIUM | 6.1 | 0.81836 | 53.04 | No | No | 2022-11-15 | 2025-04-30 | euvd | In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's `/login` endpoint.In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's `/login` endpoint. |
CVE-2024-24809 | HIGH | 8.5 | 0.54413 | 53.04 | No | No | 2024-04-10 | 2024-08-01 | euvd | Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with d…Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering an account and exploit this vulnerability to upload files with the prefix `device.` under any folder. Attackers can use this vulnerability for phishing, cross-site scripting attacks, and potentially execute arbitrary commands on the server. Version 6.0 contains a patch for the issue. |
CVE-2021-39316 | HIGH | 7.5 | 0.65763 | 53.02 | No | No | 2021-08-31 | 2025-05-05 | euvd | The Zoomsounds plugin <= 6.45 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be dow…The Zoomsounds plugin <= 6.45 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the `dzsap_download` action using directory traversal in the `link` parameter. |
CVE-2021-21480 | HIGH | 8.8 | 0.50913 | 53.02 | No | No | 2021-03-09 | 2025-05-05 | euvd | SAP MII allows users to create dashboards and save them as JSP through the SSCE (Self Service Composition Environment). An attacker can inte…SAP MII allows users to create dashboards and save them as JSP through the SSCE (Self Service Composition Environment). An attacker can intercept a request to the server, inject malicious JSP code in the request and forward to server. When this dashboard is opened by users having at least SAP_XMII Developer role, malicious content in the dashboard gets executed, leading to remote code execution in the server, which allows privilege escalation. The malicious JSP code can contain certain OS commands, through which an attacker can read sensitive files in the server, modify files or even delete contents in the server thus compromising the confidentiality, integrity and availability of the server hosting the SAP MII application. Also, an attacker authenticated as a developer can use the application to upload and execute a file which will permit them to execute operating systems commands completely compromising the server hosting the application. |
CVE-2025-7441 | CRITICAL | 9.8 | 0.39494 | 53.02 | No | No | 2025-08-16 | 2026-04-08 | euvd | The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0.42. This vulnerability…The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0.42. This vulnerability occurs through the /wp-json/storychief/webhook REST-API endpoint that does not have sufficient filetype validation. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. |