CVE-2022-42496 | CRITICAL | 9.8 | 0.02067 | 39.92 | No | No | 2022-12-05 | 2025-04-24 | euvd | OS command injection vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earlier allows a remote attacker to …OS command injection vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earlier allows a remote attacker to obtain appkey of the product and execute an arbitrary OS command on the product. |
CVE-2022-36954 | CRITICAL | 9.9 | 0.00926 | 39.92 | No | No | 2022-07-27 | 2024-08-03 | euvd | In Veritas NetBackup OpsCenter, under specific conditions, an authenticated remote attacker may be able to create or modify OpsCenter user a…In Veritas NetBackup OpsCenter, under specific conditions, an authenticated remote attacker may be able to create or modify OpsCenter user accounts. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10. |
CVE-2023-22781 | CRITICAL | 9.8 | 0.02068 | 39.92 | No | No | 2023-05-08 | 2025-01-31 | euvd | There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendin…There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system. |
CVE-2023-22784 | CRITICAL | 9.8 | 0.02068 | 39.92 | No | No | 2023-05-08 | 2025-01-31 | euvd | There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendin…There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system. |
CVE-2025-57174 | CRITICAL | 9.8 | 0.02061 | 39.92 | No | No | 2025-09-15 | 2026-07-05 | euvd | An issue was discovered in Siklu Communications Etherhaul 8010TX and 1200FX devices, Firmware 7.4.0 through 10.7.3 and possibly other previo…An issue was discovered in Siklu Communications Etherhaul 8010TX and 1200FX devices, Firmware 7.4.0 through 10.7.3 and possibly other previous versions. The rfpiped service listening on TCP port 555 which uses static AES encryption keys hardcoded in the binary. These keys are identical across all devices, allowing attackers to craft encrypted packets that execute arbitrary commands without authentication. This is a failed patch for CVE-2017-7318. This issue may affect other Etherhaul series devices with shared firmware. |
CVE-2023-22782 | CRITICAL | 9.8 | 0.02068 | 39.92 | No | No | 2023-05-08 | 2025-01-31 | euvd | There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendin…There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system. |
CVE-2023-22780 | CRITICAL | 9.8 | 0.02068 | 39.92 | No | No | 2023-05-08 | 2025-01-29 | euvd | There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendin…There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system. |
CVE-2023-22785 | CRITICAL | 9.8 | 0.02068 | 39.92 | No | No | 2023-05-08 | 2025-01-31 | euvd | There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendin…There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system. |
CVE-2023-22783 | CRITICAL | 9.8 | 0.02068 | 39.92 | No | No | 2023-05-08 | 2025-01-31 | euvd | There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendin…There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system. |
CVE-2021-1275 | CRITICAL | 9.8 | 0.02065 | 39.92 | No | No | 2021-05-06 | 2024-11-08 | euvd | Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain …Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive information, or allow an authenticated, local attacker to gain escalated privileges or gain unauthorized access to the application. For more information about these vulnerabilities, see the Details section of this advisory. |
CVE-2020-7701 | CRITICAL | 9.8 | 0.02055 | 39.92 | No | No | 2020-08-14 | 2024-09-17 | euvd | madlib-object-utils before 0.1.7 is vulnerable to Prototype Pollution via setValue.madlib-object-utils before 0.1.7 is vulnerable to Prototype Pollution via setValue. |
CVE-2021-41299 | CRITICAL | 9.8 | 0.02055 | 39.92 | No | No | 2021-09-30 | 2024-09-16 | euvd | ECOA BAS controller is vulnerable to hard-coded credentials within its Linux distribution image, thus remote attackers can obtain administra…ECOA BAS controller is vulnerable to hard-coded credentials within its Linux distribution image, thus remote attackers can obtain administrator’s privilege without logging in. |
CVE-2024-6342 | CRITICAL | 9.8 | 0.02064 | 39.92 | No | No | 2024-09-10 | 2024-09-10 | euvd | **UNSUPPORTED WHEN ASSIGNED** A command injection vulnerability in the export-cgi program of Zyxel NAS326 firmware versions through V5.21(AA…**UNSUPPORTED WHEN ASSIGNED** A command injection vulnerability in the export-cgi program of Zyxel NAS326 firmware versions through V5.21(AAZF.18)C0 and NAS542 firmware versions through V5.21(ABAG.15)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request. |
CVE-2024-21855 | CRITICAL | 9.8 | 0.02053 | 39.92 | No | No | 2024-11-21 | 2024-11-21 | euvd | A lack of authentication vulnerability exists in the HTTP API functionality of GoCast 1.1.3. A specially crafted HTTP request can lead to ar…A lack of authentication vulnerability exists in the HTTP API functionality of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability. |
CVE-2025-69902 | CRITICAL | 9.8 | 0.02057 | 39.92 | No | No | 2026-03-16 | 2026-03-17 | euvd | A command injection vulnerability in the minimal_wrapper.py component of kubectl-mcp-server v1.2.0 allows attackers to execute arbitrary com…A command injection vulnerability in the minimal_wrapper.py component of kubectl-mcp-server v1.2.0 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters. |
CVE-2021-32531 | CRITICAL | 9.8 | 0.02058 | 39.92 | No | No | 2021-07-07 | 2024-09-17 | euvd | OS command injection vulnerability in Init function in QSAN XEVO allows remote attackers to execute arbitrary commands without permissions. …OS command injection vulnerability in Init function in QSAN XEVO allows remote attackers to execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN XEVO v2.1.0. |
CVE-2025-21415 | CRITICAL | 9.9 | 0.00923 | 39.92 | No | No | 2025-01-29 | 2026-06-09 | euvd | Authentication bypass by spoofing in Azure AI Face Service allows an authorized attacker to elevate privileges over a network.Authentication bypass by spoofing in Azure AI Face Service allows an authorized attacker to elevate privileges over a network. |
CVE-2022-41203 | CRITICAL | 9.9 | 0.00924 | 39.92 | No | No | 2022-11-08 | 2025-05-01 | euvd | In some workflow of SAP BusinessObjects BI Platform (Central Management Console and BI LaunchPad), an authenticated attacker with low privil…In some workflow of SAP BusinessObjects BI Platform (Central Management Console and BI LaunchPad), an authenticated attacker with low privileges can intercept a serialized object in the parameters and substitute with another malicious serialized object, which leads to deserialization of untrusted data vulnerability. This could highly compromise the Confidentiality, Integrity, and Availability of the system. |
CVE-2023-34478 | CRITICAL | 9.8 | 0.02057 | 39.92 | No | Yes | 2023-07-24 | 2025-02-13 | euvd, github | Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when us…Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests.
Mitigation: Update to Apache Shiro 1.12.0+ or 2.0.0-alpha-3+ |
CVE-2023-35982 | CRITICAL | 9.8 | 0.02068 | 39.92 | No | No | 2023-07-25 | 2024-11-07 | euvd | There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendin…There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system. |
CVE-2023-35981 | CRITICAL | 9.8 | 0.02068 | 39.92 | No | No | 2023-07-25 | 2024-11-07 | euvd | There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendin…There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system. |
CVE-2023-35980 | CRITICAL | 9.8 | 0.02068 | 39.92 | No | No | 2023-07-25 | 2024-11-07 | euvd | There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendin…There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system. |
CVE-2021-23484 | CRITICAL | 9.8 | 0.0205 | 39.92 | No | No | 2022-01-28 | 2024-09-16 | euvd | The package zip-local before 0.3.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) which can lead to an extraction …The package zip-local before 0.3.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) which can lead to an extraction of a crafted file outside the intended extraction directory. |
CVE-2022-40089 | CRITICAL | 9.8 | 0.02059 | 39.92 | No | No | 2022-09-22 | 2025-05-27 | euvd | A remote file inclusion (RFI) vulnerability in Simple College Website v1.0 allows attackers to execute arbitrary code via a crafted PHP file…A remote file inclusion (RFI) vulnerability in Simple College Website v1.0 allows attackers to execute arbitrary code via a crafted PHP file. This vulnerability is exploitable when the directive allow_url_include is set to On. |
CVE-2007-4040 | HIGH | 8.8 | 0.13472 | 39.92 | No | No | 2007-07-27 | 2025-04-03 | euvd | Argument injection vulnerability involving Microsoft Outlook and Outlook Express, when certain URIs are registered, allows remote attackers …Argument injection vulnerability involving Microsoft Outlook and Outlook Express, when certain URIs are registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in an unspecified URI, which are inserted into the command line when invoking the handling process, a similar issue to CVE-2007-3670. |
CVE-2023-30053 | CRITICAL | 9.8 | 0.02063 | 39.92 | No | No | 2023-05-05 | 2025-01-29 | euvd | TOTOLINK A7100RU V7.4cu.2313_B20191024 is vulnerable to Command Injection.TOTOLINK A7100RU V7.4cu.2313_B20191024 is vulnerable to Command Injection. |
CVE-2025-30390 | CRITICAL | 9.9 | 0.00922 | 39.92 | No | No | 2025-04-30 | 2026-08-10 | euvd | Improper authorization in Azure allows an authorized attacker to elevate privileges over a network.Improper authorization in Azure allows an authorized attacker to elevate privileges over a network. |
CVE-2022-4170 | CRITICAL | 9.8 | 0.02058 | 39.92 | No | No | 2022-12-09 | 2025-04-14 | euvd | The rxvt-unicode package is vulnerable to a remote code execution, in the Perl background extension, when an attacker can control the data w…The rxvt-unicode package is vulnerable to a remote code execution, in the Perl background extension, when an attacker can control the data written to the user's terminal and certain options are set. |
CVE-2023-27135 | CRITICAL | 9.8 | 0.02047 | 39.92 | No | No | 2023-03-23 | 2025-02-25 | euvd | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the enabled parameter at /setting/set…TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the enabled parameter at /setting/setWanIeCfg. |
CVE-2023-33476 | CRITICAL | 9.8 | 0.02061 | 39.92 | No | No | 2023-06-02 | 2025-01-08 | euvd | ReadyMedia (MiniDLNA) versions from 1.1.15 up to 1.3.2 is vulnerable to Buffer Overflow. The vulnerability is caused by incorrect validation…ReadyMedia (MiniDLNA) versions from 1.1.15 up to 1.3.2 is vulnerable to Buffer Overflow. The vulnerability is caused by incorrect validation logic when handling HTTP requests using chunked transport encoding. This results in other code later using attacker-controlled chunk values that exceed the length of the allocated buffer, resulting in out-of-bounds read/write. |
CVE-2025-69971 | CRITICAL | 9.8 | 0.02036 | 39.91 | No | No | 2026-02-03 | 2026-02-28 | euvd | FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign…FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication to gain full administrative access. |
CVE-2023-27229 | CRITICAL | 9.8 | 0.02023 | 39.91 | No | No | 2023-03-28 | 2025-02-18 | euvd | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the upBw parameter at /setting/setWan…TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the upBw parameter at /setting/setWanIeCfg. |
CVE-2026-49049 | HIGH | 7.5 | 0.28307 | 39.91 | No | Yes | 2026-06-29 | 2026-08-12 | euvd, github | The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary …The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters. |
CVE-2023-51984 | CRITICAL | 9.8 | 0.02024 | 39.91 | No | No | 2024-01-11 | 2025-06-16 | euvd | D-Link DIR-822+ V1.0.2 was found to contain a command injection in SetStaticRouteSettings function. allows remote attackers to execute arbit…D-Link DIR-822+ V1.0.2 was found to contain a command injection in SetStaticRouteSettings function. allows remote attackers to execute arbitrary commands via shell. |
CVE-2024-31390 | CRITICAL | 9.9 | 0.00895 | 39.91 | No | No | 2024-04-03 | 2026-04-28 | euvd | : Improper Control of Generation of Code ('Code Injection') vulnerability in Soflyy Breakdance allows : Code Injection.This issue affects Br…: Improper Control of Generation of Code ('Code Injection') vulnerability in Soflyy Breakdance allows : Code Injection.This issue affects Breakdance: from n/a through 1.7.2. |
CVE-2023-28250 | CRITICAL | 9.8 | 0.02026 | 39.91 | No | No | 2023-04-11 | 2025-01-23 | euvd | Windows Pragmatic General Multicast (PGM) Remote Code Execution VulnerabilityWindows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability |
CVE-2023-32015 | CRITICAL | 9.8 | 0.02038 | 39.91 | No | No | 2023-06-13 | 2025-01-01 | euvd | Windows Pragmatic General Multicast (PGM) Remote Code Execution VulnerabilityWindows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability |
CVE-2021-1468 | CRITICAL | 9.8 | 0.02018 | 39.91 | No | No | 2021-05-06 | 2024-11-08 | euvd | Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain …Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive information, or allow an authenticated, local attacker to gain escalated privileges or gain unauthorized access to the application. For more information about these vulnerabilities, see the Details section of this advisory. |
CVE-2022-36934 | CRITICAL | 9.8 | 0.02034 | 39.91 | No | No | 2022-09-22 | 2025-05-27 | euvd | An integer overflow in WhatsApp could result in remote code execution in an established video call.An integer overflow in WhatsApp could result in remote code execution in an established video call. |
CVE-2022-42925 | CRITICAL | 9.9 | 0.00887 | 39.91 | No | No | 2022-10-31 | 2025-05-06 | euvd | There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to pri…There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to privilege escalate in order to upload a Zip file through the plugin upload component. The exploitation of this vulnerability could lead to a remote code injection. |
CVE-2023-39457 | CRITICAL | 9.8 | 0.02032 | 39.91 | No | No | 2024-05-03 | 2024-08-02 | euvd | Triangle MicroWorks SCADA Data Gateway Missing Authentication Vulnerability. This vulnerability allows remote attackers to bypass authentica…Triangle MicroWorks SCADA Data Gateway Missing Authentication Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Triangle MicroWorks SCADA Data Gateway. Authentication is not required to exploit this vulnerability.
The specific flaw exists due to the lack of user authentication. The issue results from missing authentication in the default system configuration. An attacker can leverage this vulnerability to execute arbitrary code in the context of root. Was ZDI-CAN-20501. |
CVE-2023-2231 | CRITICAL | 9.8 | 0.02019 | 39.91 | No | No | 2023-04-21 | 2024-08-02 | euvd | A vulnerability, which was classified as critical, was found in MAXTECH MAX-G866ac 0.4.1_TBRO_20160314. This affects an unknown part of the …A vulnerability, which was classified as critical, was found in MAXTECH MAX-G866ac 0.4.1_TBRO_20160314. This affects an unknown part of the component Remote Management. The manipulation leads to missing authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227001 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. |
CVE-2022-41681 | CRITICAL | 9.9 | 0.00887 | 39.91 | No | No | 2022-10-31 | 2025-05-06 | euvd | There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to pri…There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to privilege escalate in order to upload a Zip file through the SCORM importer feature. The exploitation of this vulnerability could lead to a remote code injection. |
CVE-2025-25570 | CRITICAL | 9.8 | 0.02021 | 39.91 | No | No | 2025-02-27 | 2025-02-28 | euvd | Vue Vben Admin 2.10.1 allows unauthorized login to the backend due to an issue with hardcoded credentials.Vue Vben Admin 2.10.1 allows unauthorized login to the backend due to an issue with hardcoded credentials. |
CVE-2026-5366 | CRITICAL | 9.9 | 0.00874 | 39.91 | No | Yes | 2026-06-20 | 2026-06-22 | euvd, packetstorm | Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of user-controlled input in the `GitRepository` stora…Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of user-controlled input in the `GitRepository` storage class. The `commit_sha` parameter, which is passed to git commands, lacks validation and does not include a `--` separator to distinguish user input from git flags. This allows attackers to inject arbitrary git flags, such as `--upload-pack`, enabling execution of external programs. Additionally, the `directories` parameter can be exploited to inject git flags during sparse-checkout operations. These vulnerabilities allow any user with deployment creation permissions to execute arbitrary commands on worker machines, compromising shared work pools in multi-tenant environments. |
CVE-2024-1783 | CRITICAL | 9.8 | 0.02029 | 39.91 | No | No | 2024-02-23 | 2024-08-12 | euvd | A vulnerability classified as critical has been found in Totolink LR1200GB 9.1.0u.6619_B20230130/9.3.5u.6698_B20230810. Affected is the func…A vulnerability classified as critical has been found in Totolink LR1200GB 9.1.0u.6619_B20230130/9.3.5u.6698_B20230810. Affected is the function loginAuth of the file /cgi-bin/cstecgi.cgi of the component Web Interface. The manipulation of the argument http_host leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-254574 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. |
CVE-2023-28413 | CRITICAL | 9.8 | 0.02021 | 39.91 | No | No | 2023-05-23 | 2025-01-31 | euvd | Directory traversal vulnerability in Snow Monkey Forms versions v5.0.6 and earlier allows a remote unauthenticated attacker to obtain sensit…Directory traversal vulnerability in Snow Monkey Forms versions v5.0.6 and earlier allows a remote unauthenticated attacker to obtain sensitive information, alter the website, or cause a denial-of-service (DoS) condition. |
CVE-2023-27231 | CRITICAL | 9.8 | 0.02023 | 39.91 | No | No | 2023-03-28 | 2025-02-18 | euvd | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the downBw parameter at /setting/setW…TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the downBw parameter at /setting/setWanIeCfg. |
CVE-2025-42967 | CRITICAL | 9.9 | 0.00878 | 39.91 | No | No | 2025-07-08 | 2026-02-26 | euvd | SAP S/4HANA and SAP SCM Characteristic Propagation has remote code execution vulnerability. This allows an attacker with user level privileg…SAP S/4HANA and SAP SCM Characteristic Propagation has remote code execution vulnerability. This allows an attacker with user level privileges to create a new report with his own code potentially gaining full control of the affected SAP system causing high impact on confidentiality, integrity, and availability of the application. |
CVE-2021-32017 | CRITICAL | 9.9 | 0.00899 | 39.91 | No | No | 2021-08-03 | 2025-05-30 | euvd | An issue was discovered in JUMP AMS 3.6.0.04.009-2487. A JUMP SOAP endpoint permitted the listing of the content of the remote file system. …An issue was discovered in JUMP AMS 3.6.0.04.009-2487. A JUMP SOAP endpoint permitted the listing of the content of the remote file system. This can be used to identify the complete server filesystem structure, i.e., identifying all the directories and files. |