CVE-2017-13014 | CRITICAL | 9.8 | 0.02527 | 40.08 | No | No | 2017-09-14 | 2025-12-04 | euvd | The White Board protocol parser in tcpdump before 4.9.2 has a buffer over-read in print-wb.c:wb_prep(), several functions.The White Board protocol parser in tcpdump before 4.9.2 has a buffer over-read in print-wb.c:wb_prep(), several functions. |
CVE-2017-13016 | CRITICAL | 9.8 | 0.02527 | 40.08 | No | No | 2017-09-14 | 2025-12-04 | euvd | The ISO ES-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:esis_print().The ISO ES-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:esis_print(). |
CVE-2017-12993 | CRITICAL | 9.8 | 0.02527 | 40.08 | No | No | 2017-09-14 | 2025-12-04 | euvd | The Juniper protocols parser in tcpdump before 4.9.2 has a buffer over-read in print-juniper.c, several functions.The Juniper protocols parser in tcpdump before 4.9.2 has a buffer over-read in print-juniper.c, several functions. |
CVE-2017-12897 | CRITICAL | 9.8 | 0.02527 | 40.08 | No | No | 2017-09-14 | 2025-12-04 | euvd | The ISO CLNS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:isoclns_print().The ISO CLNS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:isoclns_print(). |
CVE-2017-12898 | CRITICAL | 9.8 | 0.02527 | 40.08 | No | No | 2017-09-14 | 2025-12-04 | euvd | The NFS parser in tcpdump before 4.9.2 has a buffer over-read in print-nfs.c:interp_reply().The NFS parser in tcpdump before 4.9.2 has a buffer over-read in print-nfs.c:interp_reply(). |
CVE-2026-0092 | HIGH | 8.0 | 0.00218 | 40.08 | No | Yes | 2026-07-03 | 2026-07-03 | cnvd, euvd, github | Google Android is a Linux-based operating system open sourced by the American company Google. There is an authorization issue vulnerability …Google Android is a Linux-based operating system open sourced by the American company Google. There is an authorization issue vulnerability in Google Android. This vulnerability is caused by a lack of permission checking, and attackers can use this vulnerability to escalate privileges. |
CVE-2025-9265 | CRITICAL | 10.0 | 0.00225 | 40.08 | No | No | 2025-10-13 | 2025-10-14 | euvd | A broken authorization vulnerability in Kiloview NDI N30 allows a remote unauthenticated attacker to deactivate user verification, giving th…A broken authorization vulnerability in Kiloview NDI N30 allows a remote unauthenticated attacker to deactivate user verification, giving them access to state changing actions that should only be initiated by administratorsThis issue affects
Kiloview NDI N30
and was fixed in Firmware version later than 2.02.0246 |
CVE-2023-48419 | CRITICAL | 10.0 | 0.00238 | 40.08 | No | No | 2024-01-02 | 2025-06-17 | euvd | An attacker in the wifi vicinity of a target Google Home can spy on the victim, resulting in Elevation of PrivilegeAn attacker in the wifi vicinity of a target Google Home can spy on the victim, resulting in Elevation of Privilege |
CVE-2021-1411 | CRITICAL | 9.9 | 0.01382 | 40.08 | No | No | 2021-03-24 | 2024-11-08 | euvd | Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker …Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system with elevated privileges, access sensitive information, intercept protected network traffic, or cause a denial of service (DoS) condition. For more information about these vulnerabilities, see the Details section of this advisory. |
CVE-2020-14524 | CRITICAL | 9.8 | 0.02515 | 40.08 | No | No | 2020-08-25 | 2024-09-17 | euvd | Softing Industrial Automation all versions prior to the latest build of version 4.47.0, The affected product is vulnerable to a heap-based b…Softing Industrial Automation all versions prior to the latest build of version 4.47.0, The affected product is vulnerable to a heap-based buffer overflow, which may allow an attacker to remotely execute arbitrary code. |
CVE-2023-5199 | CRITICAL | 9.9 | 0.01383 | 40.08 | No | No | 2023-10-30 | 2026-04-08 | euvd | The PHP to Page plugin for WordPress is vulnerable Local File Inclusion to Remote Code Execution in versions up to, and including, 0.3 via t…The PHP to Page plugin for WordPress is vulnerable Local File Inclusion to Remote Code Execution in versions up to, and including, 0.3 via the 'php-to-page' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to include local file and potentially execute code on the server. While subscribers may need to poison log files or otherwise get a file installed in order to achieve remote code execution, author and above users can upload files by default and achieve remote code execution easily. |
CVE-2023-36910 | CRITICAL | 9.8 | 0.0251 | 40.08 | No | No | 2023-08-08 | 2026-08-10 | euvd, nvd | Microsoft Message Queuing (MSMQ) Remote Code Execution VulnerabilityMicrosoft Message Queuing (MSMQ) Remote Code Execution Vulnerability |
CVE-2023-48426 | CRITICAL | 10.0 | 0.00238 | 40.08 | No | No | 2024-04-05 | 2025-03-28 | euvd | u-boot bug that allows for u-boot shell and interrupt over UARTu-boot bug that allows for u-boot shell and interrupt over UART |
CVE-2025-44136 | CRITICAL | 9.8 | 0.02507 | 40.08 | No | No | 2025-07-29 | 2025-07-29 | euvd | MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS). The GET parameter "layer" is reflected in an error message without…MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS). The GET parameter "layer" is reflected in an error message without html encoding. This leads to XSS and allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victim's browser. |
CVE-2019-13657 | CRITICAL | 9.8 | 0.02502 | 40.08 | No | No | 2019-10-17 | 2024-09-17 | euvd | CA Performance Management 3.5.x, 3.6.x before 3.6.9, and 3.7.x before 3.7.4 have a default credential vulnerability that can allow a remote …CA Performance Management 3.5.x, 3.6.x before 3.6.9, and 3.7.x before 3.7.4 have a default credential vulnerability that can allow a remote attacker to execute arbitrary commands and compromise system security. |
CVE-2017-13006 | CRITICAL | 9.8 | 0.02527 | 40.08 | No | No | 2017-09-14 | 2025-12-04 | euvd | The L2TP parser in tcpdump before 4.9.2 has a buffer over-read in print-l2tp.c, several functions.The L2TP parser in tcpdump before 4.9.2 has a buffer over-read in print-l2tp.c, several functions. |
CVE-2025-12478 | CRITICAL | 10.0 | 0.00226 | 40.08 | No | No | 2025-10-29 | 2025-10-29 | euvd | Non-Compliant TLS Configuration.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .Non-Compliant TLS Configuration.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . |
CVE-2024-22004 | CRITICAL | 10.0 | 0.00238 | 40.08 | No | No | 2024-04-05 | 2024-08-01 | euvd | Due to length check, an attacker with privilege access on a Linux Nonsecure operating system can trigger a vulnerability and leak the secure…Due to length check, an attacker with privilege access on a Linux Nonsecure operating system can trigger a vulnerability and leak the secure memory from the Trusted Application |
CVE-2025-50460 | CRITICAL | 9.8 | 0.02473 | 40.07 | No | No | 2025-08-01 | 2025-08-01 | euvd | A remote code execution (RCE) vulnerability exists in the ms-swift project version 3.3.0 due to unsafe deserialization in tests/run.py using…A remote code execution (RCE) vulnerability exists in the ms-swift project version 3.3.0 due to unsafe deserialization in tests/run.py using yaml.load() from the PyYAML library (versions = 5.3.1). If an attacker can control the content of the YAML configuration file passed to the --run_config parameter, arbitrary code can be executed during deserialization. This can lead to full system compromise. The vulnerability is triggered when a malicious YAML file is loaded, allowing the execution of arbitrary Python commands such as os.system(). It is recommended to upgrade PyYAML to version 5.4 or higher, and to use yaml.safe_load() to mitigate the issue. |
CVE-2020-14510 | CRITICAL | 9.8 | 0.02487 | 40.07 | No | No | 2020-08-25 | 2024-09-16 | euvd | GateManager versions prior to 9.2c, The affected product contains a hard-coded credential for telnet, allowing an unprivileged attacker to e…GateManager versions prior to 9.2c, The affected product contains a hard-coded credential for telnet, allowing an unprivileged attacker to execute commands as root. |
CVE-2025-48611 | CRITICAL | 10.0 | 0.00193 | 40.07 | No | No | 2026-03-10 | 2026-03-16 | euvd | In DeviceId of DeviceId.java, there is a possible desync in persistence due to a missing bounds check. This could lead to local escalation o…In DeviceId of DeviceId.java, there is a possible desync in persistence due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
CVE-2024-47039 | CRITICAL | 10.0 | 0.00195 | 40.07 | No | No | 2024-12-18 | 2024-12-18 | euvd | In isSlotMarkedSuccessful of BootControl.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local…In isSlotMarkedSuccessful of BootControl.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
CVE-2025-12553 | CRITICAL | 10.0 | 0.00205 | 40.07 | No | No | 2025-10-31 | 2025-10-31 | euvd | Email Server Certificate Verification Disabled.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.Email Server Certificate Verification Disabled.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2020-7782 | CRITICAL | 9.8 | 0.02472 | 40.07 | No | No | 2021-02-08 | 2024-09-16 | euvd | This affects all versions of package spritesheet-js. It depends on a vulnerable package platform-command. The injection point is located in …This affects all versions of package spritesheet-js. It depends on a vulnerable package platform-command. The injection point is located in line 32 in lib/generator.js, which is triggered by main entry of the package. |
CVE-2025-22968 | CRITICAL | 9.8 | 0.02497 | 40.07 | No | No | 2025-01-15 | 2025-03-14 | euvd | An issue in D-Link DWR-M972V 1.05SSG allows a remote attacker to execute arbitrary code via SSH using root account without restrictionsAn issue in D-Link DWR-M972V 1.05SSG allows a remote attacker to execute arbitrary code via SSH using root account without restrictions |
CVE-2020-27127 | CRITICAL | 9.9 | 0.01335 | 40.07 | No | No | 2020-12-11 | 2024-11-13 | euvd | Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an attacker to execute a…Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system (OS) with elevated privileges or gain access to sensitive information. For more information about these vulnerabilities, see the Details section of this advisory. |
CVE-2026-48772 | CRITICAL | 10.0 | 0.00212 | 40.07 | No | No | 2026-06-19 | 2026-06-22 | euvd, nvd | ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 2.0.0 through 3.0.8, the ProxySQL MySQL frontend accepts the…ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 2.0.0 through 3.0.8, the ProxySQL MySQL frontend accepts the `PROXY UNKNOWN <addr> <addr> <port> <port>\r\n` PP1 frame as a well-formed PROXY protocol header. The HAProxy PROXY protocol v1 specification says that when the protocol token is `UNKNOWN`, the receiver MUST ignore any address fields that follow it, because the proxy has declared it cannot determine the client identity. ProxySQL parses those address fields anyway via `sscanf` and writes the spoofed source address into the session's `addr.addr` field. From there it flows directly into the query-rule matcher, where the `client_addr` predicate decides routing and ACL. When `mysql-proxy_protocol_networks = '*'` (the default), any TCP peer can send a PP1 frame and choose any source IP claim. With that, any `mysql_query_rules` row pinned to a `client_addr` value is forgeable: the attacker writes the address they want to match into the PP1 line, and ProxySQL routes their query as if it came from that address. In practice this is a routing and ACL bypass. Real deployments use `client_addr` for read-write splitting (internal apps go to the primary, public traffic to read replicas), per-app schema pinning, and query-filter rules (DDL allowed only from admin CIDR, public queries blocked from dangerous patterns). An attacker that can reach the frontend port can forge their way into any of those routes. Version 3.0.9 patches this issue. |
CVE-2016-6531 | CRITICAL | 9.8 | 0.02489 | 40.07 | No | No | 2016-09-24 | 2024-08-06 | euvd | Open Dental 16.1 and earlier has a hardcoded MySQL root password, which allows remote attackers to obtain administrative access by leveragin…Open Dental 16.1 and earlier has a hardcoded MySQL root password, which allows remote attackers to obtain administrative access by leveraging access to intranet TCP port 3306. NOTE: the vendor disputes this issue, stating that the "vulnerability note ... is factually false ... there is indeed a default blank password, but it can be changed ... We recommend that users change it, each customer receives direction. |
CVE-2026-26791 | CRITICAL | 9.8 | 0.02488 | 40.07 | No | No | 2026-03-12 | 2026-03-14 | euvd | GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the string port parameter in the enable_echo_ser…GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the string port parameter in the enable_echo_server function. This vulnerability allows attackers to execute arbitrary commands via a crafted input. |
CVE-2026-26795 | CRITICAL | 9.8 | 0.02488 | 40.07 | No | No | 2026-03-12 | 2026-03-14 | euvd | GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the module parameter in the M.get_system_log fun…GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the module parameter in the M.get_system_log function. This vulnerability allows attackers to execute arbitrary commands via a crafted input. |
CVE-2020-7785 | CRITICAL | 9.8 | 0.02472 | 40.07 | No | No | 2021-02-08 | 2024-09-16 | euvd | This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js.This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js. |
CVE-2022-24856 | CRITICAL | 9.1 | 0.10479 | 40.07 | No | No | 2022-05-17 | 2025-04-23 | euvd | FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request for…FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery (SSRF) when FlyteConsole is open to the general internet. An attacker can exploit any user of a vulnerable instance to access the internal metadata server or other unauthenticated URLs. Passing of headers to an unauthorized actor may occur. The patch for this issue deletes the entire `cors_proxy`, as this is not required for console anymore. A patch is available in FlyteConsole version 0.52.0. Disable FlyteConsole availability on the internet as a workaround. |
CVE-2026-34865 | CRITICAL | 10.0 | 0.00211 | 40.07 | No | No | 2026-04-13 | 2026-04-13 | cnvd, euvd | Out-of-bounds write vulnerability in the WEB module.Impact: Successful exploitation of this vulnerability will affect availability and confi…Out-of-bounds write vulnerability in the WEB module.Impact: Successful exploitation of this vulnerability will affect availability and confidentiality. |
CVE-2018-5553 | CRITICAL | 9.8 | 0.02486 | 40.07 | No | No | 2018-07-10 | 2024-09-16 | euvd | The Crestron Console service running on DGE-100, DM-DGE-200-C, and TS-1542-C devices with default configuration and running firmware version…The Crestron Console service running on DGE-100, DM-DGE-200-C, and TS-1542-C devices with default configuration and running firmware versions 1.3384.00049.001 and lower are vulnerable to command injection that can be used to gain root-level access. |
CVE-2023-27078 | CRITICAL | 9.8 | 0.0249 | 40.07 | No | No | 2023-03-23 | 2025-02-25 | euvd | A command injection issue was found in TP-Link MR3020 v.1_150921 that allows a remote attacker to execute arbitrary commands via a crafted r…A command injection issue was found in TP-Link MR3020 v.1_150921 that allows a remote attacker to execute arbitrary commands via a crafted request to the tftp endpoint. |
CVE-2001-1125 | CRITICAL | 9.8 | 0.02474 | 40.07 | No | No | 2002-03-15 | 2025-01-16 | euvd | Symantec LiveUpdate before 1.6 does not use cryptography to ensure the integrity of download files, which allows remote attackers to execute…Symantec LiveUpdate before 1.6 does not use cryptography to ensure the integrity of download files, which allows remote attackers to execute arbitrary code via DNS spoofing of the update.symantec.com site. |
CVE-2023-27874 | CRITICAL | 9.9 | 0.01343 | 40.07 | No | No | 2023-03-21 | 2025-02-26 | euvd | IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated atta…IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands. IBM X-Force ID: 249845. |
CVE-2018-4404 | HIGH | 8.8 | 0.13919 | 40.07 | No | No | 2019-01-11 | 2024-08-05 | euvd | In iOS before 11.4 and macOS High Sierra before 10.13.5, a memory corruption issue exists and was addressed with improved memory handling.In iOS before 11.4 and macOS High Sierra before 10.13.5, a memory corruption issue exists and was addressed with improved memory handling. |
CVE-2024-47038 | CRITICAL | 10.0 | 0.00213 | 40.07 | No | No | 2024-12-18 | 2024-12-18 | euvd | In dhd_prot_flowrings_pool_release of dhd_msgbuf.c, there is a possible outcof bounds write due to a missing bounds check. This could lead t…In dhd_prot_flowrings_pool_release of dhd_msgbuf.c, there is a possible outcof bounds write due to a missing bounds check. This could lead to localcescalation of privilege with no additional execution privileges needed. Usercinteraction is not needed for exploitation. |
CVE-2026-26830 | CRITICAL | 9.8 | 0.02493 | 40.07 | No | Yes | 2026-03-25 | 2026-03-27 | euvd, packetstorm | pdf-image (npm package) through version 2.0.0 allows OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and con…pdf-image (npm package) through version 2.0.0 allows OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and constructConvertCommandForPage functions use util.format() to interpolate user-controlled file paths into shell command strings that are executed via child_process.exec() |
CVE-2023-51887 | CRITICAL | 9.8 | 0.02472 | 40.07 | No | No | 2024-01-24 | 2025-06-20 | euvd | Command Injection vulnerability in Mathtex v.1.05 and before allows a remote attacker to execute arbitrary code via crafted string in applic…Command Injection vulnerability in Mathtex v.1.05 and before allows a remote attacker to execute arbitrary code via crafted string in application URL. |
CVE-2025-22939 | CRITICAL | 9.8 | 0.02498 | 40.07 | No | No | 2025-03-31 | 2025-08-18 | euvd | A command injection vulnerability in the telnet service of Adtran 411 ONT L80.00.0011.M2 allows attackers to escalate privileges to root and…A command injection vulnerability in the telnet service of Adtran 411 ONT L80.00.0011.M2 allows attackers to escalate privileges to root and execute arbitrary commands. |
CVE-2018-7790 | CRITICAL | 9.8 | 0.02478 | 40.07 | No | No | 2018-08-29 | 2026-05-29 | euvd | An Information Management Error vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to fir…An Information Management Error vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). The vulnerability allows unauthorized users to replay authentication sequences. If an attacker exploits this vulnerability and connects to a Modicon M221, the attacker can upload the original program from the PLC. |
CVE-2019-1149 | HIGH | 8.8 | 0.13904 | 40.07 | No | No | 2019-08-14 | 2024-08-04 | euvd | A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker …A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploited the vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
There are multiple ways an attacker could exploit the vulnerability:
In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability and then convince users to view the website. An attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by getting them to click a link in an email or instant message that takes users to the attacker's website, or by opening an attachment sent through email.
In a file-sharing attack scenario, an attacker could provide a specially crafted document file designed to exploit the vulnerability and then convince users to open the document file.
The security update addresses the vulnerability by correcting how the Windows font library handles embedded fonts. |
CVE-2025-12216 | CRITICAL | 10.0 | 0.00202 | 40.07 | No | No | 2025-10-25 | 2025-10-28 | euvd | Malicious / Malformed App can be Installed but not Uninstalled/may lead to unavailability.This issue affects BLU-IC2: through 1.19.5; BLU-IC…Malicious / Malformed App can be Installed but not Uninstalled/may lead to unavailability.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-12425 | CRITICAL | 10.0 | 0.00203 | 40.07 | No | No | 2025-10-28 | 2025-10-28 | euvd | Local Privilege Escalation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .Local Privilege Escalation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . |
CVE-2022-43545 | CRITICAL | 9.9 | 0.01355 | 40.07 | No | No | 2022-11-08 | 2024-08-03 | euvd | A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER M…A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10). Affected devices do not properly validate the RecordType-parameter in requests to the web interface on port 443/tcp. This could allow an authenticated remote attacker to crash the device (followed by an automatic reboot) or to execute arbitrary code on the device. |
CVE-2021-1471 | CRITICAL | 9.9 | 0.01323 | 40.06 | No | No | 2021-03-24 | 2024-11-08 | euvd | Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker …Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system with elevated privileges, access sensitive information, intercept protected network traffic, or cause a denial of service (DoS) condition. For more information about these vulnerabilities, see the Details section of this advisory. |
CVE-2024-47040 | CRITICAL | 10.0 | 0.00179 | 40.06 | No | No | 2024-12-18 | 2024-12-18 | euvd | There is a possible UAF due to a logic error in the code. This could lead to local escalation of privilege with no additional execution priv…There is a possible UAF due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
CVE-2024-48904 | CRITICAL | 9.8 | 0.02444 | 40.06 | No | No | 2024-10-22 | 2024-10-22 | euvd | An command injection vulnerability in Trend Micro Cloud Edge could allow a remote attacker to execute arbitrary code on affected appliances.…An command injection vulnerability in Trend Micro Cloud Edge could allow a remote attacker to execute arbitrary code on affected appliances.
Please note: authentication is not required in order to exploit this vulnerability. |